@velajs/cloudflare 1.28.0 → 1.29.0

package/dist/durable-objects.js.map

@@ -1 +1 @@
-{"version":3,"file":"durable-objects.js","names":[],"sources":["../src/websocket/cf-room-registry.ts","../src/websocket/do-websocket-host.ts","../src/websocket/do-bootstrap.ts","../src/websocket/websocket.durable-object.ts","../src/nonce/nonce.durable-object.ts"],"sourcesContent":["import { WebSocketSendGate, type WebSocketSendPolicy } from '@velajs/vela/websocket';\nimport { socketAttachment, rejectedAttachment } from './ws-attachment';\nimport type { BroadcastCommand, RoomRegistry, WsClient } from '@velajs/vela/websocket';\nimport type { DoStateLike, WsAttachment, WsLike } from './do-state';\nimport { CfWsClient } from './cf-ws-client';\n\n/**\n * Core `RoomRegistry` backed by a Durable Object's hibernatable sockets. Room\n * membership lives in tags (hub room, set at accept) + the attachment (dynamic\n * `join()`), never in DO instance fields — so it survives hibernation with zero\n * rehydration.\n */\nexport class CfRoomRegistry implements RoomRegistry {\n  readonly #sendGates = new WeakMap<WsLike, WebSocketSendGate>();\n  #sendPolicyForPath?: (path: string) => WebSocketSendPolicy | undefined;\n\n  setSendPolicyResolver(resolve: (path: string) => WebSocketSendPolicy | undefined): void {\n    this.#sendPolicyForPath = resolve;\n  }\n\n  private deliveryAuthorizer?: (client: WsClient) => boolean | Promise<boolean>;\n  private frameLimitForPath?: (path: string) => number | undefined;\n\n  constructor(private readonly ctx: DoStateLike) {}\n\n  setDeliveryAuthorizer(authorizer: (client: WsClient) => boolean | Promise<boolean>): void {\n    this.deliveryAuthorizer = authorizer;\n  }\n\n  /** Reconcile pre-migration/woken attachments with authoritative gateway metadata. */\n  setFrameLimitResolver(resolver: (path: string) => number | undefined): void {\n    this.frameLimitForPath = resolver;\n  }\n\n  // CF sockets are registered with the DO by `acceptWebSocket`; nothing to track.\n  register(_client: WsClient): void {}\n  leaveAll(_client: WsClient): void {}\n\n  join(client: WsClient, room: string): void | Promise<void> {\n    return client.join(room);\n  }\n\n  leave(client: WsClient, room: string): void | Promise<void> {\n    return client.leave(room);\n  }\n\n  localIdsInRoom(room: string): string[] {\n    return this.socketsForRoom(room).map((ws) => this.attachmentOf(ws).connId);\n  }\n\n  deliverLocal(cmd: BroadcastCommand): void | Promise<void> {\n    const excludeIds = new Set(cmd.exceptIds ?? []);\n    const excludeRooms = cmd.exceptRooms ?? [];\n\n    // Empty `rooms` => GLOBAL (every socket in this DO). Otherwise the union of\n    // targeted rooms, deduped per connection.\n    const targets =\n      cmd.rooms.length === 0 ? this.ctx.getWebSockets() : this.collectRooms(cmd.rooms);\n\n    const seen = new Set<string>();\n    const selected: Array<{ ws: WsLike; client: WsClient }> = [];\n    for (const ws of targets) {\n      const att = this.reconcileFrameLimit(ws, this.attachmentOf(ws));\n      if (\n        att.state !== 'active' ||\n        (att.expiresAtMs !== undefined &&\n          (!Number.isSafeInteger(att.expiresAtMs) || att.expiresAtMs <= Date.now()))\n      ) {\n        try {\n          att.state = 'rejected';\n          ws.serializeAttachment(att);\n          ws.close(1008, 'identity expired or connection rejected');\n        } catch {\n          // already closed or malformed attachment\n        }\n        continue;\n      }\n      if (seen.has(att.connId)) continue;\n      seen.add(att.connId);\n      if (excludeIds.has(att.connId)) continue;\n      if (excludeRooms.some((r) => att.rooms.includes(r))) continue;\n      selected.push({ ws, client: this.clientFor(ws) });\n    }\n\n    if (!this.deliveryAuthorizer) {\n      for (const { client } of selected) client.sendRaw(cmd.frame);\n      return;\n    }\n    return Promise.all(\n      selected.map(async ({ ws, client }) => {\n        let allowed = false;\n        try {\n          allowed = (await this.deliveryAuthorizer!(client)) === true;\n        } catch {\n          allowed = false;\n        }\n        if (allowed) client.sendRaw(cmd.frame);\n        else this.reject(ws, 'delivery authorization revoked');\n      }),\n    ).then(() => undefined);\n  }\n\n  private collectRooms(rooms: string[]): WsLike[] {\n    const set = new Set<WsLike>();\n    for (const room of rooms) for (const ws of this.socketsForRoom(room)) set.add(ws);\n    return [...set];\n  }\n\n  private socketsForRoom(room: string): WsLike[] {\n    // Membership is the attachment's `rooms`, NOT the hibernation tag: tags are\n    // immutable after acceptWebSocket, so a socket that left its hub room still\n    // carries the tag. Since one DO ≈ one room, scanning all sockets in the DO\n    // and filtering by attachment is both correct and cheap.\n    return this.ctx.getWebSockets().filter((ws) => this.attachmentOf(ws).rooms.includes(room));\n  }\n\n  private attachmentOf(ws: WsLike): WsAttachment {\n    return socketAttachment(ws) ?? rejectedAttachment();\n  }\n\n  /** Reconstruct a `WsClient` for a raw socket (e.g. inside gateway lifecycle scans). */\n  clientFor(ws: WsLike): CfWsClient {\n    this.reconcileFrameLimit(ws, this.attachmentOf(ws));\n    let gate = this.#sendGates.get(ws);\n    if (!gate) {\n      gate = new WebSocketSendGate(this.#sendPolicyForPath?.(this.attachmentOf(ws).path));\n      this.#sendGates.set(ws, gate);\n    }\n    return new CfWsClient(this.ctx, ws, gate);\n  }\n\n  private reconcileFrameLimit(ws: WsLike, attachment: WsAttachment): WsAttachment {\n    const expected = this.frameLimitForPath?.(attachment.path);\n    if (expected !== undefined && attachment.maxFrameBytes !== expected) {\n      attachment.maxFrameBytes = expected;\n      ws.serializeAttachment(attachment);\n    }\n    return attachment;\n  }\n\n  private reject(ws: WsLike, reason: string): void {\n    try {\n      const attachment = this.attachmentOf(ws);\n      attachment.state = 'rejected';\n      ws.serializeAttachment(attachment);\n      ws.close(1008, reason);\n    } catch {\n      // already closed or malformed attachment\n    }\n  }\n}\n","import { socketAttachment } from './ws-attachment';\nimport { WsMessageQueue, assertBroadcastCommandFits } from '@velajs/vela/websocket';\nimport type { BroadcastCommand, WsDispatcher } from '@velajs/vela/websocket';\nimport type { CfRoomRegistry } from './cf-room-registry';\nimport {\n  MAX_WS_ATTACHMENT_BYTES,\n  type DoStateLike,\n  type WsAttachment,\n  type WsLike,\n} from './do-state';\nimport { connTag, roomTag } from './room-id';\n\nexport interface WsConnectionPrincipal {\n  issuer: string;\n  subject: string;\n  principalType: 'user' | 'service';\n  tenantId: string;\n}\n\n/**\n * The socket lifecycle inside a WebSocket Durable Object, decoupled from the\n * `cloudflare:workers` base class so it is unit-testable with fakes. The thin\n * `VelaWebSocketDurableObject` shell forwards its hibernation callbacks here.\n */\nexport class DoWebSocketHost {\n  readonly #messages = new WeakMap<WsLike, WsMessageQueue>();\n  constructor(\n    private readonly ctx: DoStateLike,\n    private readonly dispatcher: WsDispatcher,\n    private readonly registry: CfRoomRegistry,\n    private readonly gatewayPaths: readonly string[] = [],\n  ) {}\n\n  /** The single registered gateway's path — a fallback when the Worker didn't forward `x-vela-path`. */\n  defaultPath(): string | undefined {\n    return this.gatewayPaths[0];\n  }\n\n  /**\n   * Accept a hibernatable socket: tag it with its hub room + connection id,\n   * persist the attachment, then await `OnGatewayConnection` before the caller\n   * returns 101. A rejected lifecycle hook closes and fails the upgrade.\n   */\n  async accept(\n    ws: WsLike,\n    path: string,\n    roomId: string,\n    userId?: string,\n    expiresAtMs?: number,\n    principal?: WsConnectionPrincipal,\n  ): Promise<boolean> {\n    const maxFrameBytes = this.dispatcher.getGatewayMaxFrameBytes(path);\n    if (maxFrameBytes === undefined) return false;\n    if (\n      expiresAtMs !== undefined &&\n      (!Number.isSafeInteger(expiresAtMs) || expiresAtMs <= Date.now())\n    ) {\n      return false;\n    }\n    if (\n      (principal !== undefined &&\n        (expiresAtMs === undefined ||\n          userId !== principal.subject ||\n          !principal.issuer ||\n          !principal.tenantId)) ||\n      (expiresAtMs !== undefined && principal === undefined)\n    ) {\n      return false;\n    }\n\n    const connId = crypto.randomUUID();\n    const attachment: WsAttachment = {\n      version: 1,\n      connId,\n      state: 'pending',\n      userId,\n      principal:\n        principal === undefined\n          ? undefined\n          : {\n              issuer: principal.issuer,\n              subject: principal.subject,\n              principalType: principal.principalType,\n            },\n      tenantId: principal?.tenantId,\n      expiresAtMs,\n      path,\n      maxFrameBytes,\n      rooms: [roomId],\n      data: {\n        ...(userId ? { userId } : {}),\n        ...(principal\n          ? {\n              principal: {\n                issuer: principal.issuer,\n                subject: principal.subject,\n                principalType: principal.principalType,\n              },\n              tenantId: principal.tenantId,\n            }\n          : {}),\n        ...(expiresAtMs !== undefined ? { expiresAtMs } : {}),\n      },\n    };\n    if (new TextEncoder().encode(JSON.stringify(attachment)).byteLength > MAX_WS_ATTACHMENT_BYTES) {\n      return false;\n    }\n    try {\n      this.ctx.acceptWebSocket(ws, [roomTag(roomId), connTag(connId)]);\n      ws.serializeAttachment(attachment);\n    } catch {\n      try {\n        ws.close(1008, 'Connection rejected');\n      } catch {\n        // already closed\n      }\n      return false;\n    }\n\n    const client = this.registry.clientFor(ws);\n    try {\n      await this.dispatcher.handleOpen(path, client);\n      // Another callback may have rejected the socket while the asynchronous\n      // connection hook was still pending. Never resurrect that terminal state\n      // after the hook resolves.\n      if (!this.transition(ws, 'active', 'pending')) {\n        throw new Error('Unable to persist authorized WebSocket state');\n      }\n      return true;\n    } catch (err) {\n      await this.dispatcher.handleError(path, client, err).catch(() => {});\n      this.transition(ws, 'rejected');\n      try {\n        ws.close(1008, 'Connection rejected');\n      } catch {\n        // already closed\n      }\n      return false;\n    }\n  }\n\n  async onMessage(ws: WsLike, message: string | ArrayBuffer): Promise<void> {\n    if (!this.isActive(ws)) {\n      this.reject(ws, 'Connection is not authorized');\n      return;\n    }\n    let queue = this.#messages.get(ws);\n    if (!queue) {\n      const path = socketAttachment(ws)?.path;\n      const options = this.dispatcher.collectEntrypoints().find((entry) => entry.meta.path === path)\n        ?.meta.options;\n      queue = new WsMessageQueue(\n        () => this.reject(ws, 'WebSocket message budget exceeded', 1013),\n        options?.maxPendingMessages,\n        options?.maxPendingBytes,\n      );\n      this.#messages.set(ws, queue);\n    }\n    await queue.run(message, async () => {\n      if (!this.isActive(ws)) return;\n      const client = this.registry.clientFor(ws);\n      await this.dispatcher.dispatchMessage(client.path, client, message);\n    });\n  }\n\n  async onClose(ws: WsLike, code: number, reason: string): Promise<void> {\n    this.#messages.get(ws)?.stop();\n    if (!this.isActive(ws, false)) {\n      this.transition(ws, 'rejected');\n      try {\n        ws.close();\n      } catch {\n        // already closed\n      }\n      return;\n    }\n    const client = this.registry.clientFor(ws);\n    await this.dispatcher.handleClose(client.path, client, code, reason);\n    // Complete the closing handshake. Only 1000 and 3000-4999 are valid for\n    // close(); reserved/abnormal codes (1005/1006/1015, etc.) throw a RangeError,\n    // so fall back to a codeless close on those.\n    try {\n      if (code === 1000 || (code >= 3000 && code <= 4999)) ws.close(code, reason);\n      else ws.close();\n    } catch {\n      // socket already closed\n    }\n  }\n\n  async onError(ws: WsLike, err: unknown): Promise<void> {\n    if (!this.isActive(ws, false)) {\n      this.reject(ws, 'Connection failed before authorization');\n      return;\n    }\n    const client = this.registry.clientFor(ws);\n    await this.dispatcher.handleError(client.path, client, err);\n  }\n\n  /** Deliver a broadcast command to this DO's local sockets (RPC entry point). */\n  broadcast(cmd: BroadcastCommand): void | Promise<void> {\n    assertBroadcastCommandFits(cmd, this.dispatcher.getMaximumGatewayFrameBytes());\n    return this.registry.deliverLocal(cmd);\n  }\n\n  private transition(\n    ws: WsLike,\n    state: WsAttachment['state'],\n    expectedState?: WsAttachment['state'],\n  ): boolean {\n    try {\n      const attachment = socketAttachment(ws);\n      if (!attachment) return false;\n      if (expectedState !== undefined && attachment.state !== expectedState) return false;\n      attachment.state = state;\n      ws.serializeAttachment(attachment);\n      return true;\n    } catch {\n      return false;\n    }\n  }\n\n  private isActive(ws: WsLike, checkExpiry = true): boolean {\n    try {\n      const attachment = socketAttachment(ws);\n      if (!attachment || attachment.state !== 'active') return false;\n      return (\n        !checkExpiry ||\n        attachment.expiresAtMs === undefined ||\n        (Number.isSafeInteger(attachment.expiresAtMs) && attachment.expiresAtMs > Date.now())\n      );\n    } catch {\n      return false;\n    }\n  }\n\n  private reject(ws: WsLike, reason: string, code = 1008): void {\n    this.#messages.get(ws)?.stop();\n    this.transition(ws, 'rejected');\n    try {\n      ws.close(code, reason);\n    } catch {\n      // already closed\n    }\n  }\n}\n","import { bootstrap, VelaApplication } from '@velajs/vela';\nimport type { InjectionToken, Type } from '@velajs/vela';\nimport {\n  local,\n  readWsEntrypointMeta,\n  WsDispatcher,\n  WsServerImpl,\n  WS_SERVER,\n} from '@velajs/vela/websocket';\nimport type { WsServer } from '@velajs/vela/websocket';\nimport type { LiveEngine } from '@velajs/vela/live';\nimport { registerCloudflareEnvironment } from '../environment';\nimport { CfWsClient } from './cf-ws-client';\nimport { CfRoomRegistry } from './cf-room-registry';\nimport { initDoLive, initializeDoLiveResources } from './do-live';\nimport type { DoStateLike } from './do-state';\nimport { WsServerHolder } from './ws-server-holder';\n\nexport interface DoRuntime {\n  dispatcher: WsDispatcher;\n  registry: CfRoomRegistry;\n  server: WsServer;\n  /** Gateway paths from `app.entrypoints.ofKind('websocket')` (discovery order). */\n  gatewayPaths: string[];\n  /** The live-query engine (undefined when the app doesn't import LiveModule). */\n  live?: LiveEngine;\n  close(signal?: string): Promise<void>;\n}\n\n/**\n * Slim DI bootstrap for the Durable Object isolate: wires the container and runs\n * `OnModuleInit`/`OnApplicationBootstrap` (so `WsDispatcher` discovers gateways)\n * WITHOUT building the Hono app/routes the DO never serves. Cloudflare binding\n * refs are initialized straight from the DO's `env`, and the ctx-backed server\n * is bound before bootstrap lifecycle so gateway `afterInit`/handlers see it.\n */\nexport async function buildDoRuntime<T extends object>(\n  rootModule: Type,\n  ctx: DoStateLike,\n  options: { env: T; envToken: InjectionToken<T> },\n): Promise<DoRuntime> {\n  const { container, routeManager, loader } = await bootstrap(rootModule, {\n    configureContainer: (container) => {\n      registerCloudflareEnvironment(container, { token: options.envToken, env: options.env });\n    },\n  });\n\n  const registry = new CfRoomRegistry(ctx);\n  const driver = local();\n  driver.bind(registry);\n  const server = new WsServerImpl(driver);\n\n  if (container.has(WS_SERVER)) {\n    const holder = await container.resolveAsync(WS_SERVER);\n    if (holder instanceof WsServerHolder) holder.setTarget(server);\n  }\n\n  const app = new VelaApplication(container, routeManager);\n  app.setInstances(await loader.resolveAllInstances());\n  initializeDoLiveResources(container, ctx);\n  await app.callOnModuleInit();\n  await app.callOnApplicationBootstrap();\n\n  // The entrypoint registry is the transport contract: one 'websocket' entry\n  // per discovered gateway ({ meta: { path, dispatcher } }). Built by\n  // callOnApplicationBootstrap(), so this slim no-routes path has it too.\n  const wsEntrypoints = app.entrypoints.ofKind('websocket', readWsEntrypointMeta);\n  const dispatcher = wsEntrypoints[0]?.meta.dispatcher ?? app.get(WsDispatcher);\n  registry.setSendPolicyResolver(\n    (path) => wsEntrypoints.find((entry) => entry.meta.path === path)?.meta.options.sendPolicy,\n  );\n  registry.setFrameLimitResolver((path) => dispatcher.getGatewayMaxFrameBytes(path));\n  registry.setDeliveryAuthorizer((client) => {\n    const path = client instanceof CfWsClient ? client.path : '';\n    return dispatcher.authorizeDelivery(path, client);\n  });\n\n  // Live queries: wire the SQLite cursor log + local driver mode and replay\n  // hibernation-persisted subscriptions into the fresh engine.\n  const live = initDoLive(app, ctx, registry);\n\n  return {\n    // Zero gateways still yields a live dispatcher (module imported, nothing\n    // decorated) — fall back to resolving it directly.\n    dispatcher,\n    registry,\n    server,\n    gatewayPaths: wsEntrypoints.map((ep) => ep.meta.path),\n    live,\n    close: (signal?: string) => app.close(signal),\n  };\n}\n","import { DurableObject } from 'cloudflare:workers';\nimport type { InjectionToken } from '@velajs/vela';\nimport type { BroadcastCommand } from '@velajs/vela/websocket';\nimport type {\n  CommitStamp,\n  InvalidationCommand,\n  LiveEngine,\n  LiveInspection,\n} from '@velajs/vela/live';\nimport { buildDoRuntime } from './do-bootstrap';\nimport { DoWebSocketHost, type WsConnectionPrincipal } from './do-websocket-host';\nimport { armDoPitr, readDoPitrBookmark } from './do-pitr';\nimport { resolveCloudflareRoot } from '../root-module';\nimport type { CloudflareRoot } from '../root-module';\nimport type {\n  DoPitrArmOptions,\n  DoPitrArmResult,\n  DoPitrBookmarkRead,\n  VelaDoPitrRpc,\n} from './do-pitr';\n\nconst PING = '{\"event\":\"$ping\"}';\nconst PONG = '{\"event\":\"$pong\"}';\nconst MAX_IDENTITY_FIELD_BYTES = 2048;\nconst encoder = new TextEncoder();\n\nfunction isIdentityField(value: string | null): value is string {\n  return (\n    value !== null &&\n    value.length > 0 &&\n    encoder.encode(value).byteLength <= MAX_IDENTITY_FIELD_BYTES\n  );\n}\n\n/**\n * Base class for the WebSocket Durable Object. The user exports a named subclass\n * (matching their `wrangler.toml` `class_name`) built from their `AppModule`:\n *\n * ```ts\n * export class ChatRoom extends VelaWebSocketDurableObject(AppModule, { envToken: ENV }) {}\n * ```\n *\n * It owns the raw hibernation socket lifecycle (Hono's `upgradeWebSocket` cannot\n * bridge DO hibernation) and forwards every event into the runtime-agnostic\n * `WsDispatcher` via {@link DoWebSocketHost}.\n */\nexport function VelaWebSocketDurableObject<T extends object>(\n  rootModule: CloudflareRoot<NoInfer<T>>,\n  options: { envToken: InjectionToken<T> },\n): new (\n  ctx: DurableObjectState,\n  env: T,\n) => DurableObject<T> &\n  VelaDoPitrRpc & {\n    broadcast(cmd: BroadcastCommand): Promise<void>;\n    invalidate(cmd: InvalidationCommand): Promise<CommitStamp | undefined>;\n    inspectLive(): Promise<LiveInspection>;\n  } {\n  return class VelaWsDurableObject extends DurableObject<T> {\n    private host!: DoWebSocketHost;\n    private liveEngine?: LiveEngine;\n    private readonly ready: Promise<void>;\n\n    constructor(ctx: DurableObjectState, env: T) {\n      super(ctx, env);\n      // Application-level ping/pong answered WITHOUT waking a hibernated DO.\n      try {\n        ctx.setWebSocketAutoResponse(new WebSocketRequestResponsePair(PING, PONG));\n      } catch {\n        // Older runtimes without auto-response — fine, protocol pings still work.\n      }\n      this.ready = ctx.blockConcurrencyWhile(async () => {\n        const runtime = await buildDoRuntime(await resolveCloudflareRoot(rootModule, env), ctx, {\n          ...options,\n          env,\n        });\n        this.host = new DoWebSocketHost(\n          ctx,\n          runtime.dispatcher,\n          runtime.registry,\n          runtime.gatewayPaths,\n        );\n        this.liveEngine = runtime.live;\n      });\n    }\n\n    /** Intra-worker RPC only; HTTP fetch never exposes this admin snapshot. */\n    async inspectLive(): Promise<LiveInspection> {\n      await this.ready;\n      return this.liveEngine?.inspect() ?? { subscriptions: [], rooms: [] };\n    }\n\n    override async fetch(request: Request): Promise<Response> {\n      await this.ready;\n      if (request.headers.get('upgrade')?.toLowerCase() !== 'websocket') {\n        return new Response('Expected WebSocket upgrade', { status: 426 });\n      }\n\n      const url = new URL(request.url);\n      // Headers are primary (carry auth + multi-gateway routing); fall back to the\n      // DO's own name (set via idFromName(room)) and the single gateway path so a\n      // plain `stub.fetch(request)` forward still works.\n      const roomId = request.headers.get('x-vela-room') ?? this.ctx.id.name ?? url.pathname;\n      const path = request.headers.get('x-vela-path') ?? this.host.defaultPath() ?? url.pathname;\n      const userId = request.headers.get('x-vela-user') || undefined;\n      const rawExpiresAtMs = request.headers.get('x-vela-expires-at-ms');\n      const parsedExpiresAtMs = rawExpiresAtMs === null ? undefined : Number(rawExpiresAtMs);\n      if (\n        parsedExpiresAtMs !== undefined &&\n        (!Number.isSafeInteger(parsedExpiresAtMs) || parsedExpiresAtMs <= 0)\n      ) {\n        return new Response('Invalid WebSocket identity expiry', { status: 403 });\n      }\n\n      const issuer = request.headers.get('x-vela-issuer');\n      const subject = request.headers.get('x-vela-subject');\n      const principalType = request.headers.get('x-vela-principal-type');\n      const tenantId = request.headers.get('x-vela-tenant');\n      const hasPrincipalHeader =\n        issuer !== null || subject !== null || principalType !== null || tenantId !== null;\n      let principal: WsConnectionPrincipal | undefined;\n      if (hasPrincipalHeader) {\n        if (\n          !isIdentityField(issuer) ||\n          !isIdentityField(subject) ||\n          (principalType !== 'user' && principalType !== 'service') ||\n          !isIdentityField(tenantId) ||\n          parsedExpiresAtMs === undefined ||\n          (userId !== undefined && userId !== subject)\n        ) {\n          return new Response('Invalid WebSocket principal', { status: 403 });\n        }\n        principal = { issuer, subject, principalType, tenantId };\n      } else if (parsedExpiresAtMs !== undefined) {\n        return new Response('WebSocket identity tuple is missing', { status: 403 });\n      }\n\n      if (parsedExpiresAtMs !== undefined && parsedExpiresAtMs <= Date.now()) {\n        return new Response('WebSocket identity expired', { status: 403 });\n      }\n\n      const { 0: client, 1: server } = new WebSocketPair();\n      const accepted = await this.host.accept(\n        server,\n        path,\n        roomId,\n        userId,\n        parsedExpiresAtMs,\n        principal,\n      );\n      if (!accepted) return new Response('WebSocket connection rejected', { status: 403 });\n      return new Response(null, { status: 101, webSocket: client });\n    }\n\n    override async webSocketMessage(ws: WebSocket, message: string | ArrayBuffer): Promise<void> {\n      await this.ready;\n      await this.host.onMessage(ws, message);\n    }\n\n    override async webSocketClose(ws: WebSocket, code: number, reason: string): Promise<void> {\n      await this.ready;\n      await this.host.onClose(ws, code, reason);\n    }\n\n    override async webSocketError(ws: WebSocket, error: unknown): Promise<void> {\n      await this.ready;\n      await this.host.onError(ws, error);\n    }\n\n    /** DO RPC — server-initiated broadcast forwarded from a Worker (see `broadcastToRoom`). */\n    async broadcast(cmd: BroadcastCommand): Promise<void> {\n      await this.ready;\n      await this.host.broadcast(cmd);\n    }\n\n    /**\n     * DO RPC — live tag invalidation forwarded from a Worker (durableObjectLive /\n     * liveInvalidateToRoom). Appends to THIS log scope's cursor log and returns\n     * the commit stamp (what `Vela-Commit-Cursor` carries); the subscription\n     * refreshes fan out asynchronously.\n     */\n    async invalidate(cmd: InvalidationCommand): Promise<CommitStamp | undefined> {\n      await this.ready;\n      return this.liveEngine?.applyInvalidation(cmd);\n    }\n\n    // -- Durable Object PITR (point-in-time recovery) RPC ---------------------\n    //\n    // GUARD / reachability: these are admin-privileged operations (a restore can\n    // roll the DO's SQLite state back up to 30 days and, with `restart`, abort\n    // the DO to apply it now). They are safe to expose here because a Durable\n    // Object's RPC methods are NOT network-reachable: a `DurableObjectStub` is\n    // obtainable ONLY from a Worker that binds this DO namespace, and RPC calls\n    // travel Cloudflare's internal capability channel — never the public\n    // internet. A WebSocket/HTTP client reaches only `fetch()` above, never these\n    // methods. The security boundary is therefore the WORKER-SIDE studio admin\n    // gate that fronts the `CloudflareDoTimeTravelPort` (master admin token + the\n    // 428 confirm challenge) — the identical trust model as `broadcast()` /\n    // `invalidate()` on this same DO. See `do-pitr.ts` for the storage wrappers.\n\n    /** DO RPC — the current PITR bookmark (typed-unavailable on a non-SQLite DO). */\n    async pitrCurrentBookmark(): Promise<DoPitrBookmarkRead> {\n      await this.ready;\n      return readDoPitrBookmark(this.ctx.storage);\n    }\n\n    /** DO RPC — the PITR bookmark closest to `time` (+ the current bookmark). */\n    async pitrBookmarkForTime(time: number | string): Promise<DoPitrBookmarkRead> {\n      await this.ready;\n      return readDoPitrBookmark(this.ctx.storage, time);\n    }\n\n    /**\n     * DO RPC — arm a PITR restore and return the undo bookmark. When `restart` is\n     * requested, `ctx.abort()` is called AFTER the undo bookmark is computed so\n     * the recovery applies on the immediately-following session; otherwise the\n     * restore applies on the next natural restart (`restarted: false`).\n     */\n    async pitrArmRestore(opts: DoPitrArmOptions): Promise<DoPitrArmResult> {\n      await this.ready;\n      const result = await armDoPitr(this.ctx.storage, opts);\n      if (opts.restart === true) this.ctx.abort('vela PITR restore');\n      return result;\n    }\n  };\n}\n","import { DurableObject } from 'cloudflare:workers';\nimport { MAX_NONCE_BYTES, isCanonicalBoundedText, isValidExpiry } from './nonce-validation';\nconst EXPIRED_DELETE_BATCH = 1_024;\n\nconst CREATE_TABLE =\n  'CREATE TABLE IF NOT EXISTS __vela_nonce_claims (' +\n  'nonce TEXT PRIMARY KEY NOT NULL, ' +\n  'expires_at INTEGER NOT NULL CHECK (expires_at > 0)' +\n  ') WITHOUT ROWID';\nconst CREATE_EXPIRY_INDEX =\n  'CREATE INDEX IF NOT EXISTS __vela_nonce_claims_expiry ON __vela_nonce_claims (expires_at)';\nconst DELETE_EXPIRED =\n  'DELETE FROM __vela_nonce_claims WHERE nonce IN (' +\n  'SELECT nonce FROM __vela_nonce_claims ' +\n  'WHERE expires_at < ? ORDER BY expires_at LIMIT ?' +\n  ')';\nconst INSERT_CLAIM =\n  'INSERT INTO __vela_nonce_claims (nonce, expires_at) VALUES (?, ?) ' +\n  'ON CONFLICT(nonce) DO NOTHING RETURNING nonce, expires_at';\n\ninterface NonceSqlCursor {\n  toArray(): Record<string, unknown>[];\n}\n\ninterface NonceSqlStorage {\n  exec(query: string, ...bindings: unknown[]): NonceSqlCursor;\n}\n\n/**\n * SQLite Durable Object that atomically consumes nonces.\n *\n * Export this class from the Worker entry and register it through a Wrangler\n * `new_sqlite_classes` migration. `INSERT ... ON CONFLICT DO NOTHING RETURNING`\n * is the single-use decision; all SQL runs synchronously before the RPC method\n * yields, and the nonce primary key is the final concurrency boundary.\n */\nexport class VelaNonceDurableObject extends DurableObject<Record<string, unknown>> {\n  private sql?: NonceSqlStorage;\n\n  constructor(ctx: DurableObjectState, env: Record<string, unknown>) {\n    super(ctx, env);\n    try {\n      const sql = ctx.storage?.sql;\n      if (!sql || typeof sql.exec !== 'function') return;\n      sql.exec(CREATE_TABLE);\n      sql.exec(CREATE_EXPIRY_INDEX);\n      this.sql = sql;\n    } catch {\n      // A non-SQLite/misconfigured class stays fail-closed: every claim denies.\n      this.sql = undefined;\n    }\n  }\n\n  async claim(nonce: string, expEpochSeconds: number): Promise<boolean> {\n    const sql = this.sql;\n    if (!sql) return false;\n\n    const now = Math.floor(Date.now() / 1_000);\n    if (!isCanonicalBoundedText(nonce, MAX_NONCE_BYTES) || !isValidExpiry(expEpochSeconds, now)) {\n      return false;\n    }\n\n    try {\n      // Keep cleanup bounded so one claim cannot monopolize the DO. Entries at\n      // exactly `now` remain: Vela's invocation verifier accepts `now === exp`.\n      sql.exec(DELETE_EXPIRED, now, EXPIRED_DELETE_BATCH);\n\n      const cursor = sql.exec(INSERT_CLAIM, nonce, expEpochSeconds);\n      if (!cursor || typeof cursor.toArray !== 'function') return false;\n      const rows: unknown = cursor.toArray();\n      if (!Array.isArray(rows) || rows.length !== 1) return false;\n\n      const row: unknown = rows[0];\n      if (typeof row !== 'object' || row === null) return false;\n      if (\n        !Object.hasOwn(row, 'nonce') ||\n        !Object.hasOwn(row, 'expires_at') ||\n        !('nonce' in row) ||\n        !('expires_at' in row)\n      ) {\n        return false;\n      }\n      return row.nonce === nonce && row.expires_at === expEpochSeconds;\n    } catch {\n      return false;\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;;AAYA,IAAa,iBAAb,MAAoD;CAWrB;CAV7B,6BAAsB,IAAI,QAAmC;CAC7D;CAEA,sBAAsB,SAAkE;EACtF,KAAK,qBAAqB;CAC5B;CAEA;CACA;CAEA,YAAY,KAAmC;EAAlB,KAAA,MAAA;CAAmB;CAEhD,sBAAsB,YAAoE;EACxF,KAAK,qBAAqB;CAC5B;;CAGA,sBAAsB,UAAsD;EAC1E,KAAK,oBAAoB;CAC3B;CAGA,SAAS,SAAyB,CAAC;CACnC,SAAS,SAAyB,CAAC;CAEnC,KAAK,QAAkB,MAAoC;EACzD,OAAO,OAAO,KAAK,IAAI;CACzB;CAEA,MAAM,QAAkB,MAAoC;EAC1D,OAAO,OAAO,MAAM,IAAI;CAC1B;CAEA,eAAe,MAAwB;EACrC,OAAO,KAAK,eAAe,IAAI,CAAC,CAAC,KAAK,OAAO,KAAK,aAAa,EAAE,CAAC,CAAC,MAAM;CAC3E;CAEA,aAAa,KAA6C;EACxD,MAAM,aAAa,IAAI,IAAI,IAAI,aAAa,CAAC,CAAC;EAC9C,MAAM,eAAe,IAAI,eAAe,CAAC;EAIzC,MAAM,UACJ,IAAI,MAAM,WAAW,IAAI,KAAK,IAAI,cAAc,IAAI,KAAK,aAAa,IAAI,KAAK;EAEjF,MAAM,uBAAO,IAAI,IAAY;EAC7B,MAAM,WAAoD,CAAC;EAC3D,KAAK,MAAM,MAAM,SAAS;GACxB,MAAM,MAAM,KAAK,oBAAoB,IAAI,KAAK,aAAa,EAAE,CAAC;GAC9D,IACE,IAAI,UAAU,YACb,IAAI,gBAAgB,KAAA,MAClB,CAAC,OAAO,cAAc,IAAI,WAAW,KAAK,IAAI,eAAe,KAAK,IAAI,IACzE;IACA,IAAI;KACF,IAAI,QAAQ;KACZ,GAAG,oBAAoB,GAAG;KAC1B,GAAG,MAAM,MAAM,yCAAyC;IAC1D,QAAQ,CAER;IACA;GACF;GACA,IAAI,KAAK,IAAI,IAAI,MAAM,GAAG;GAC1B,KAAK,IAAI,IAAI,MAAM;GACnB,IAAI,WAAW,IAAI,IAAI,MAAM,GAAG;GAChC,IAAI,aAAa,MAAM,MAAM,IAAI,MAAM,SAAS,CAAC,CAAC,GAAG;GACrD,SAAS,KAAK;IAAE;IAAI,QAAQ,KAAK,UAAU,EAAE;GAAE,CAAC;EAClD;EAEA,IAAI,CAAC,KAAK,oBAAoB;GAC5B,KAAK,MAAM,EAAE,YAAY,UAAU,OAAO,QAAQ,IAAI,KAAK;GAC3D;EACF;EACA,OAAO,QAAQ,IACb,SAAS,IAAI,OAAO,EAAE,IAAI,aAAa;GACrC,IAAI,UAAU;GACd,IAAI;IACF,UAAW,MAAM,KAAK,mBAAoB,MAAM,MAAO;GACzD,QAAQ;IACN,UAAU;GACZ;GACA,IAAI,SAAS,OAAO,QAAQ,IAAI,KAAK;QAChC,KAAK,OAAO,IAAI,gCAAgC;EACvD,CAAC,CACH,CAAC,CAAC,WAAW,KAAA,CAAS;CACxB;CAEA,aAAqB,OAA2B;EAC9C,MAAM,sBAAM,IAAI,IAAY;EAC5B,KAAK,MAAM,QAAQ,OAAO,KAAK,MAAM,MAAM,KAAK,eAAe,IAAI,GAAG,IAAI,IAAI,EAAE;EAChF,OAAO,CAAC,GAAG,GAAG;CAChB;CAEA,eAAuB,MAAwB;EAK7C,OAAO,KAAK,IAAI,cAAc,CAAC,CAAC,QAAQ,OAAO,KAAK,aAAa,EAAE,CAAC,CAAC,MAAM,SAAS,IAAI,CAAC;CAC3F;CAEA,aAAqB,IAA0B;EAC7C,OAAO,iBAAiB,EAAE,KAAK,mBAAmB;CACpD;;CAGA,UAAU,IAAwB;EAChC,KAAK,oBAAoB,IAAI,KAAK,aAAa,EAAE,CAAC;EAClD,IAAI,OAAO,KAAK,WAAW,IAAI,EAAE;EACjC,IAAI,CAAC,MAAM;GACT,OAAO,IAAI,kBAAkB,KAAK,qBAAqB,KAAK,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC;GAClF,KAAK,WAAW,IAAI,IAAI,IAAI;EAC9B;EACA,OAAO,IAAI,WAAW,KAAK,KAAK,IAAI,IAAI;CAC1C;CAEA,oBAA4B,IAAY,YAAwC;EAC9E,MAAM,WAAW,KAAK,oBAAoB,WAAW,IAAI;EACzD,IAAI,aAAa,KAAA,KAAa,WAAW,kBAAkB,UAAU;GACnE,WAAW,gBAAgB;GAC3B,GAAG,oBAAoB,UAAU;EACnC;EACA,OAAO;CACT;CAEA,OAAe,IAAY,QAAsB;EAC/C,IAAI;GACF,MAAM,aAAa,KAAK,aAAa,EAAE;GACvC,WAAW,QAAQ;GACnB,GAAG,oBAAoB,UAAU;GACjC,GAAG,MAAM,MAAM,MAAM;EACvB,QAAQ,CAER;CACF;AACF;;;;;;;;AC9HA,IAAa,kBAAb,MAA6B;CAGR;CACA;CACA;CACA;CALnB,4BAAqB,IAAI,QAAgC;CACzD,YACE,KACA,YACA,UACA,eAAmD,CAAC,GACpD;EAJiB,KAAA,MAAA;EACA,KAAA,aAAA;EACA,KAAA,WAAA;EACA,KAAA,eAAA;CAChB;;CAGH,cAAkC;EAChC,OAAO,KAAK,aAAa;CAC3B;;;;;;CAOA,MAAM,OACJ,IACA,MACA,QACA,QACA,aACA,WACkB;EAClB,MAAM,gBAAgB,KAAK,WAAW,wBAAwB,IAAI;EAClE,IAAI,kBAAkB,KAAA,GAAW,OAAO;EACxC,IACE,gBAAgB,KAAA,MACf,CAAC,OAAO,cAAc,WAAW,KAAK,eAAe,KAAK,IAAI,IAE/D,OAAO;EAET,IACG,cAAc,KAAA,MACZ,gBAAgB,KAAA,KACf,WAAW,UAAU,WACrB,CAAC,UAAU,UACX,CAAC,UAAU,aACd,gBAAgB,KAAA,KAAa,cAAc,KAAA,GAE5C,OAAO;EAGT,MAAM,SAAS,OAAO,WAAW;EACjC,MAAM,aAA2B;GAC/B,SAAS;GACT;GACA,OAAO;GACP;GACA,WACE,cAAc,KAAA,IACV,KAAA,IACA;IACE,QAAQ,UAAU;IAClB,SAAS,UAAU;IACnB,eAAe,UAAU;GAC3B;GACN,UAAU,WAAW;GACrB;GACA;GACA;GACA,OAAO,CAAC,MAAM;GACd,MAAM;IACJ,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;IAC3B,GAAI,YACA;KACE,WAAW;MACT,QAAQ,UAAU;MAClB,SAAS,UAAU;MACnB,eAAe,UAAU;KAC3B;KACA,UAAU,UAAU;IACtB,IACA,CAAC;IACL,GAAI,gBAAgB,KAAA,IAAY,EAAE,YAAY,IAAI,CAAC;GACrD;EACF;EACA,IAAI,IAAI,YAAY,CAAC,CAAC,OAAO,KAAK,UAAU,UAAU,CAAC,CAAC,CAAC,aAAA,OACvD,OAAO;EAET,IAAI;GACF,KAAK,IAAI,gBAAgB,IAAI,CAAC,QAAQ,MAAM,GAAG,QAAQ,MAAM,CAAC,CAAC;GAC/D,GAAG,oBAAoB,UAAU;EACnC,QAAQ;GACN,IAAI;IACF,GAAG,MAAM,MAAM,qBAAqB;GACtC,QAAQ,CAER;GACA,OAAO;EACT;EAEA,MAAM,SAAS,KAAK,SAAS,UAAU,EAAE;EACzC,IAAI;GACF,MAAM,KAAK,WAAW,WAAW,MAAM,MAAM;GAI7C,IAAI,CAAC,KAAK,WAAW,IAAI,UAAU,SAAS,GAC1C,MAAM,IAAI,MAAM,8CAA8C;GAEhE,OAAO;EACT,SAAS,KAAK;GACZ,MAAM,KAAK,WAAW,YAAY,MAAM,QAAQ,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC;GACnE,KAAK,WAAW,IAAI,UAAU;GAC9B,IAAI;IACF,GAAG,MAAM,MAAM,qBAAqB;GACtC,QAAQ,CAER;GACA,OAAO;EACT;CACF;CAEA,MAAM,UAAU,IAAY,SAA8C;EACxE,IAAI,CAAC,KAAK,SAAS,EAAE,GAAG;GACtB,KAAK,OAAO,IAAI,8BAA8B;GAC9C;EACF;EACA,IAAI,QAAQ,KAAK,UAAU,IAAI,EAAE;EACjC,IAAI,CAAC,OAAO;GACV,MAAM,OAAO,iBAAiB,EAAE,CAAC,EAAE;GACnC,MAAM,UAAU,KAAK,WAAW,mBAAmB,CAAC,CAAC,MAAM,UAAU,MAAM,KAAK,SAAS,IAAI,CAAC,EAC1F,KAAK;GACT,QAAQ,IAAI,qBACJ,KAAK,OAAO,IAAI,qCAAqC,IAAI,GAC/D,SAAS,oBACT,SAAS,eACX;GACA,KAAK,UAAU,IAAI,IAAI,KAAK;EAC9B;EACA,MAAM,MAAM,IAAI,SAAS,YAAY;GACnC,IAAI,CAAC,KAAK,SAAS,EAAE,GAAG;GACxB,MAAM,SAAS,KAAK,SAAS,UAAU,EAAE;GACzC,MAAM,KAAK,WAAW,gBAAgB,OAAO,MAAM,QAAQ,OAAO;EACpE,CAAC;CACH;CAEA,MAAM,QAAQ,IAAY,MAAc,QAA+B;EACrE,KAAK,UAAU,IAAI,EAAE,CAAC,EAAE,KAAK;EAC7B,IAAI,CAAC,KAAK,SAAS,IAAI,KAAK,GAAG;GAC7B,KAAK,WAAW,IAAI,UAAU;GAC9B,IAAI;IACF,GAAG,MAAM;GACX,QAAQ,CAER;GACA;EACF;EACA,MAAM,SAAS,KAAK,SAAS,UAAU,EAAE;EACzC,MAAM,KAAK,WAAW,YAAY,OAAO,MAAM,QAAQ,MAAM,MAAM;EAInE,IAAI;GACF,IAAI,SAAS,OAAS,QAAQ,OAAQ,QAAQ,MAAO,GAAG,MAAM,MAAM,MAAM;QACrE,GAAG,MAAM;EAChB,QAAQ,CAER;CACF;CAEA,MAAM,QAAQ,IAAY,KAA6B;EACrD,IAAI,CAAC,KAAK,SAAS,IAAI,KAAK,GAAG;GAC7B,KAAK,OAAO,IAAI,wCAAwC;GACxD;EACF;EACA,MAAM,SAAS,KAAK,SAAS,UAAU,EAAE;EACzC,MAAM,KAAK,WAAW,YAAY,OAAO,MAAM,QAAQ,GAAG;CAC5D;;CAGA,UAAU,KAA6C;EACrD,2BAA2B,KAAK,KAAK,WAAW,4BAA4B,CAAC;EAC7E,OAAO,KAAK,SAAS,aAAa,GAAG;CACvC;CAEA,WACE,IACA,OACA,eACS;EACT,IAAI;GACF,MAAM,aAAa,iBAAiB,EAAE;GACtC,IAAI,CAAC,YAAY,OAAO;GACxB,IAAI,kBAAkB,KAAA,KAAa,WAAW,UAAU,eAAe,OAAO;GAC9E,WAAW,QAAQ;GACnB,GAAG,oBAAoB,UAAU;GACjC,OAAO;EACT,QAAQ;GACN,OAAO;EACT;CACF;CAEA,SAAiB,IAAY,cAAc,MAAe;EACxD,IAAI;GACF,MAAM,aAAa,iBAAiB,EAAE;GACtC,IAAI,CAAC,cAAc,WAAW,UAAU,UAAU,OAAO;GACzD,OACE,CAAC,eACD,WAAW,gBAAgB,KAAA,KAC1B,OAAO,cAAc,WAAW,WAAW,KAAK,WAAW,cAAc,KAAK,IAAI;EAEvF,QAAQ;GACN,OAAO;EACT;CACF;CAEA,OAAe,IAAY,QAAgB,OAAO,MAAY;EAC5D,KAAK,UAAU,IAAI,EAAE,CAAC,EAAE,KAAK;EAC7B,KAAK,WAAW,IAAI,UAAU;EAC9B,IAAI;GACF,GAAG,MAAM,MAAM,MAAM;EACvB,QAAQ,CAER;CACF;AACF;;;;;;;;;;AChNA,eAAsB,eACpB,YACA,KACA,SACoB;CACpB,MAAM,EAAE,WAAW,cAAc,WAAW,MAAM,UAAU,YAAY,EACtE,qBAAqB,cAAc;EACjC,8BAA8B,WAAW;GAAE,OAAO,QAAQ;GAAU,KAAK,QAAQ;EAAI,CAAC;CACxF,EACF,CAAC;CAED,MAAM,WAAW,IAAI,eAAe,GAAG;CACvC,MAAM,SAAS,MAAM;CACrB,OAAO,KAAK,QAAQ;CACpB,MAAM,SAAS,IAAI,aAAa,MAAM;CAEtC,IAAI,UAAU,IAAI,SAAS,GAAG;EAC5B,MAAM,SAAS,MAAM,UAAU,aAAa,SAAS;EACrD,IAAI,kBAAkB,gBAAgB,OAAO,UAAU,MAAM;CAC/D;CAEA,MAAM,MAAM,IAAI,gBAAgB,WAAW,YAAY;CACvD,IAAI,aAAa,MAAM,OAAO,oBAAoB,CAAC;CACnD,0BAA0B,WAAW,GAAG;CACxC,MAAM,IAAI,iBAAiB;CAC3B,MAAM,IAAI,2BAA2B;CAKrC,MAAM,gBAAgB,IAAI,YAAY,OAAO,aAAa,oBAAoB;CAC9E,MAAM,aAAa,cAAc,EAAE,EAAE,KAAK,cAAc,IAAI,IAAI,YAAY;CAC5E,SAAS,uBACN,SAAS,cAAc,MAAM,UAAU,MAAM,KAAK,SAAS,IAAI,CAAC,EAAE,KAAK,QAAQ,UAClF;CACA,SAAS,uBAAuB,SAAS,WAAW,wBAAwB,IAAI,CAAC;CACjF,SAAS,uBAAuB,WAAW;EACzC,MAAM,OAAO,kBAAkB,aAAa,OAAO,OAAO;EAC1D,OAAO,WAAW,kBAAkB,MAAM,MAAM;CAClD,CAAC;CAID,MAAM,OAAO,WAAW,KAAK,KAAK,QAAQ;CAE1C,OAAO;EAGL;EACA;EACA;EACA,cAAc,cAAc,KAAK,OAAO,GAAG,KAAK,IAAI;EACpD;EACA,QAAQ,WAAoB,IAAI,MAAM,MAAM;CAC9C;AACF;;;ACtEA,MAAM,OAAO;AACb,MAAM,OAAO;AACb,MAAM,2BAA2B;AACjC,MAAM,UAAU,IAAI,YAAY;AAEhC,SAAS,gBAAgB,OAAuC;CAC9D,OACE,UAAU,QACV,MAAM,SAAS,KACf,QAAQ,OAAO,KAAK,CAAC,CAAC,cAAc;AAExC;;;;;;;;;;;;;AAcA,SAAgB,2BACd,YACA,SASE;CACF,OAAO,MAAM,4BAA4B,cAAiB;EACxD;EACA;EACA;EAEA,YAAY,KAAyB,KAAQ;GAC3C,MAAM,KAAK,GAAG;GAEd,IAAI;IACF,IAAI,yBAAyB,IAAI,6BAA6B,MAAM,IAAI,CAAC;GAC3E,QAAQ,CAER;GACA,KAAK,QAAQ,IAAI,sBAAsB,YAAY;IACjD,MAAM,UAAU,MAAM,eAAe,MAAM,sBAAsB,YAAY,GAAG,GAAG,KAAK;KACtF,GAAG;KACH;IACF,CAAC;IACD,KAAK,OAAO,IAAI,gBACd,KACA,QAAQ,YACR,QAAQ,UACR,QAAQ,YACV;IACA,KAAK,aAAa,QAAQ;GAC5B,CAAC;EACH;;EAGA,MAAM,cAAuC;GAC3C,MAAM,KAAK;GACX,OAAO,KAAK,YAAY,QAAQ,KAAK;IAAE,eAAe,CAAC;IAAG,OAAO,CAAC;GAAE;EACtE;EAEA,MAAe,MAAM,SAAqC;GACxD,MAAM,KAAK;GACX,IAAI,QAAQ,QAAQ,IAAI,SAAS,CAAC,EAAE,YAAY,MAAM,aACpD,OAAO,IAAI,SAAS,8BAA8B,EAAE,QAAQ,IAAI,CAAC;GAGnE,MAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;GAI/B,MAAM,SAAS,QAAQ,QAAQ,IAAI,aAAa,KAAK,KAAK,IAAI,GAAG,QAAQ,IAAI;GAC7E,MAAM,OAAO,QAAQ,QAAQ,IAAI,aAAa,KAAK,KAAK,KAAK,YAAY,KAAK,IAAI;GAClF,MAAM,SAAS,QAAQ,QAAQ,IAAI,aAAa,KAAK,KAAA;GACrD,MAAM,iBAAiB,QAAQ,QAAQ,IAAI,sBAAsB;GACjE,MAAM,oBAAoB,mBAAmB,OAAO,KAAA,IAAY,OAAO,cAAc;GACrF,IACE,sBAAsB,KAAA,MACrB,CAAC,OAAO,cAAc,iBAAiB,KAAK,qBAAqB,IAElE,OAAO,IAAI,SAAS,qCAAqC,EAAE,QAAQ,IAAI,CAAC;GAG1E,MAAM,SAAS,QAAQ,QAAQ,IAAI,eAAe;GAClD,MAAM,UAAU,QAAQ,QAAQ,IAAI,gBAAgB;GACpD,MAAM,gBAAgB,QAAQ,QAAQ,IAAI,uBAAuB;GACjE,MAAM,WAAW,QAAQ,QAAQ,IAAI,eAAe;GACpD,MAAM,qBACJ,WAAW,QAAQ,YAAY,QAAQ,kBAAkB,QAAQ,aAAa;GAChF,IAAI;GACJ,IAAI,oBAAoB;IACtB,IACE,CAAC,gBAAgB,MAAM,KACvB,CAAC,gBAAgB,OAAO,KACvB,kBAAkB,UAAU,kBAAkB,aAC/C,CAAC,gBAAgB,QAAQ,KACzB,sBAAsB,KAAA,KACrB,WAAW,KAAA,KAAa,WAAW,SAEpC,OAAO,IAAI,SAAS,+BAA+B,EAAE,QAAQ,IAAI,CAAC;IAEpE,YAAY;KAAE;KAAQ;KAAS;KAAe;IAAS;GACzD,OAAO,IAAI,sBAAsB,KAAA,GAC/B,OAAO,IAAI,SAAS,uCAAuC,EAAE,QAAQ,IAAI,CAAC;GAG5E,IAAI,sBAAsB,KAAA,KAAa,qBAAqB,KAAK,IAAI,GACnE,OAAO,IAAI,SAAS,8BAA8B,EAAE,QAAQ,IAAI,CAAC;GAGnE,MAAM,EAAE,GAAG,QAAQ,GAAG,WAAW,IAAI,cAAc;GASnD,IAAI,CAAC,MARkB,KAAK,KAAK,OAC/B,QACA,MACA,QACA,QACA,mBACA,SACF,GACe,OAAO,IAAI,SAAS,iCAAiC,EAAE,QAAQ,IAAI,CAAC;GACnF,OAAO,IAAI,SAAS,MAAM;IAAE,QAAQ;IAAK,WAAW;GAAO,CAAC;EAC9D;EAEA,MAAe,iBAAiB,IAAe,SAA8C;GAC3F,MAAM,KAAK;GACX,MAAM,KAAK,KAAK,UAAU,IAAI,OAAO;EACvC;EAEA,MAAe,eAAe,IAAe,MAAc,QAA+B;GACxF,MAAM,KAAK;GACX,MAAM,KAAK,KAAK,QAAQ,IAAI,MAAM,MAAM;EAC1C;EAEA,MAAe,eAAe,IAAe,OAA+B;GAC1E,MAAM,KAAK;GACX,MAAM,KAAK,KAAK,QAAQ,IAAI,KAAK;EACnC;;EAGA,MAAM,UAAU,KAAsC;GACpD,MAAM,KAAK;GACX,MAAM,KAAK,KAAK,UAAU,GAAG;EAC/B;;;;;;;EAQA,MAAM,WAAW,KAA4D;GAC3E,MAAM,KAAK;GACX,OAAO,KAAK,YAAY,kBAAkB,GAAG;EAC/C;;EAiBA,MAAM,sBAAmD;GACvD,MAAM,KAAK;GACX,OAAO,mBAAmB,KAAK,IAAI,OAAO;EAC5C;;EAGA,MAAM,oBAAoB,MAAoD;GAC5E,MAAM,KAAK;GACX,OAAO,mBAAmB,KAAK,IAAI,SAAS,IAAI;EAClD;;;;;;;EAQA,MAAM,eAAe,MAAkD;GACrE,MAAM,KAAK;GACX,MAAM,SAAS,MAAM,UAAU,KAAK,IAAI,SAAS,IAAI;GACrD,IAAI,KAAK,YAAY,MAAM,KAAK,IAAI,MAAM,mBAAmB;GAC7D,OAAO;EACT;CACF;AACF;;;AC/NA,MAAM,uBAAuB;AAE7B,MAAM,eACJ;AAIF,MAAM,sBACJ;AACF,MAAM,iBACJ;AAIF,MAAM,eACJ;;;;;;;;;AAmBF,IAAa,yBAAb,cAA4C,cAAuC;CACjF;CAEA,YAAY,KAAyB,KAA8B;EACjE,MAAM,KAAK,GAAG;EACd,IAAI;GACF,MAAM,MAAM,IAAI,SAAS;GACzB,IAAI,CAAC,OAAO,OAAO,IAAI,SAAS,YAAY;GAC5C,IAAI,KAAK,YAAY;GACrB,IAAI,KAAK,mBAAmB;GAC5B,KAAK,MAAM;EACb,QAAQ;GAEN,KAAK,MAAM,KAAA;EACb;CACF;CAEA,MAAM,MAAM,OAAe,iBAA2C;EACpE,MAAM,MAAM,KAAK;EACjB,IAAI,CAAC,KAAK,OAAO;EAEjB,MAAM,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAK;EACzC,IAAI,CAAC,uBAAuB,OAAA,GAAsB,KAAK,CAAC,cAAc,iBAAiB,GAAG,GACxF,OAAO;EAGT,IAAI;GAGF,IAAI,KAAK,gBAAgB,KAAK,oBAAoB;GAElD,MAAM,SAAS,IAAI,KAAK,cAAc,OAAO,eAAe;GAC5D,IAAI,CAAC,UAAU,OAAO,OAAO,YAAY,YAAY,OAAO;GAC5D,MAAM,OAAgB,OAAO,QAAQ;GACrC,IAAI,CAAC,MAAM,QAAQ,IAAI,KAAK,KAAK,WAAW,GAAG,OAAO;GAEtD,MAAM,MAAe,KAAK;GAC1B,IAAI,OAAO,QAAQ,YAAY,QAAQ,MAAM,OAAO;GACpD,IACE,CAAC,OAAO,OAAO,KAAK,OAAO,KAC3B,CAAC,OAAO,OAAO,KAAK,YAAY,KAChC,EAAE,WAAW,QACb,EAAE,gBAAgB,MAElB,OAAO;GAET,OAAO,IAAI,UAAU,SAAS,IAAI,eAAe;EACnD,QAAQ;GACN,OAAO;EACT;CACF;AACF"}
+{"version":3,"file":"durable-objects.js","names":[],"sources":["../src/websocket/cf-room-registry.ts","../src/websocket/do-websocket-host.ts","../src/websocket/do-bootstrap.ts","../src/websocket/websocket.durable-object.ts","../src/nonce/nonce.durable-object.ts"],"sourcesContent":["import { WebSocketSendGate, type WebSocketSendPolicy } from '@velajs/vela/websocket';\nimport { socketAttachment, rejectedAttachment } from './ws-attachment';\nimport type { BroadcastCommand, RoomRegistry, WsClient } from '@velajs/vela/websocket';\nimport type { DoStateLike, WsAttachment, WsLike } from './do-state';\nimport { CfWsClient } from './cf-ws-client';\n\n/**\n * Core `RoomRegistry` backed by a Durable Object's hibernatable sockets. Room\n * membership lives in tags (hub room, set at accept) + the attachment (dynamic\n * `join()`), never in DO instance fields — so it survives hibernation with zero\n * rehydration.\n */\nexport class CfRoomRegistry implements RoomRegistry {\n  readonly #sendGates = new WeakMap<WsLike, WebSocketSendGate>();\n  // Sockets whose OnGatewayConnection hook is running in this instance. They\n  // are still `pending`, so broadcasts skip them; any other pending socket\n  // never finished admission and is closed when a broadcast reaches it.\n  readonly #admitting = new WeakSet<WsLike>();\n  #sendPolicyForPath?: (path: string) => WebSocketSendPolicy | undefined;\n\n  setSendPolicyResolver(resolve: (path: string) => WebSocketSendPolicy | undefined): void {\n    this.#sendPolicyForPath = resolve;\n  }\n\n  private deliveryAuthorizer?: (client: WsClient) => boolean | Promise<boolean>;\n  private frameLimitForPath?: (path: string) => number | undefined;\n\n  constructor(private readonly ctx: DoStateLike) {}\n\n  setDeliveryAuthorizer(authorizer: (client: WsClient) => boolean | Promise<boolean>): void {\n    this.deliveryAuthorizer = authorizer;\n  }\n\n  /** Reconcile pre-migration/woken attachments with authoritative gateway metadata. */\n  setFrameLimitResolver(resolver: (path: string) => number | undefined): void {\n    this.frameLimitForPath = resolver;\n  }\n\n  /**\n   * Run `admit` (the connection hook) with `ws` marked as being admitted, so a\n   * broadcast issued meanwhile (for example `server.emit()` announcing the new\n   * connection) skips the still-pending socket instead of rejecting it.\n   */\n  async admitting<T>(ws: WsLike, admit: () => Promise<T>): Promise<T> {\n    this.#admitting.add(ws);\n    try {\n      return await admit();\n    } finally {\n      this.#admitting.delete(ws);\n    }\n  }\n\n  // CF sockets are registered with the DO by `acceptWebSocket`; nothing to track.\n  register(_client: WsClient): void {}\n  leaveAll(_client: WsClient): void {}\n\n  join(client: WsClient, room: string): void | Promise<void> {\n    return client.join(room);\n  }\n\n  leave(client: WsClient, room: string): void | Promise<void> {\n    return client.leave(room);\n  }\n\n  localIdsInRoom(room: string): string[] {\n    return this.socketsForRoom(room).map((ws) => this.attachmentOf(ws).connId);\n  }\n\n  deliverLocal(cmd: BroadcastCommand): void | Promise<void> {\n    const excludeIds = new Set(cmd.exceptIds ?? []);\n    const excludeRooms = cmd.exceptRooms ?? [];\n\n    // Empty `rooms` => GLOBAL (every socket in this DO). Otherwise the union of\n    // targeted rooms, deduped per connection.\n    const targets =\n      cmd.rooms.length === 0 ? this.ctx.getWebSockets() : this.collectRooms(cmd.rooms);\n\n    const seen = new Set<string>();\n    const selected: Array<{ ws: WsLike; client: WsClient }> = [];\n    for (const ws of targets) {\n      const att = this.reconcileFrameLimit(ws, this.attachmentOf(ws));\n      // A socket still in its connection hook is not admitted yet: it receives no\n      // room frames, and its own accept() settles it. Rejecting it here would\n      // close every client whose handleConnection broadcasts to the room. Other\n      // pending sockets fall through and are rejected below.\n      if (att.state === 'pending' && this.#admitting.has(ws)) continue;\n      if (\n        att.state !== 'active' ||\n        (att.expiresAtMs !== undefined &&\n          (!Number.isSafeInteger(att.expiresAtMs) || att.expiresAtMs <= Date.now()))\n      ) {\n        try {\n          att.state = 'rejected';\n          ws.serializeAttachment(att);\n          ws.close(1008, 'identity expired or connection rejected');\n        } catch {\n          // already closed or malformed attachment\n        }\n        continue;\n      }\n      if (seen.has(att.connId)) continue;\n      seen.add(att.connId);\n      if (excludeIds.has(att.connId)) continue;\n      if (excludeRooms.some((r) => att.rooms.includes(r))) continue;\n      selected.push({ ws, client: this.clientFor(ws) });\n    }\n\n    if (!this.deliveryAuthorizer) {\n      for (const { client } of selected) client.sendRaw(cmd.frame);\n      return;\n    }\n    return Promise.all(\n      selected.map(async ({ ws, client }) => {\n        let allowed = false;\n        try {\n          allowed = (await this.deliveryAuthorizer!(client)) === true;\n        } catch {\n          allowed = false;\n        }\n        if (allowed) client.sendRaw(cmd.frame);\n        else this.reject(ws, 'delivery authorization revoked');\n      }),\n    ).then(() => undefined);\n  }\n\n  private collectRooms(rooms: string[]): WsLike[] {\n    const set = new Set<WsLike>();\n    for (const room of rooms) for (const ws of this.socketsForRoom(room)) set.add(ws);\n    return [...set];\n  }\n\n  private socketsForRoom(room: string): WsLike[] {\n    // Membership is the attachment's `rooms`, NOT the hibernation tag: tags are\n    // immutable after acceptWebSocket, so a socket that left its hub room still\n    // carries the tag. Since one DO ≈ one room, scanning all sockets in the DO\n    // and filtering by attachment is both correct and cheap.\n    return this.ctx.getWebSockets().filter((ws) => this.attachmentOf(ws).rooms.includes(room));\n  }\n\n  private attachmentOf(ws: WsLike): WsAttachment {\n    return socketAttachment(ws) ?? rejectedAttachment();\n  }\n\n  /** Reconstruct a `WsClient` for a raw socket (e.g. inside gateway lifecycle scans). */\n  clientFor(ws: WsLike): CfWsClient {\n    this.reconcileFrameLimit(ws, this.attachmentOf(ws));\n    let gate = this.#sendGates.get(ws);\n    if (!gate) {\n      gate = new WebSocketSendGate(this.#sendPolicyForPath?.(this.attachmentOf(ws).path));\n      this.#sendGates.set(ws, gate);\n    }\n    return new CfWsClient(this.ctx, ws, gate);\n  }\n\n  private reconcileFrameLimit(ws: WsLike, attachment: WsAttachment): WsAttachment {\n    const expected = this.frameLimitForPath?.(attachment.path);\n    if (expected !== undefined && attachment.maxFrameBytes !== expected) {\n      attachment.maxFrameBytes = expected;\n      ws.serializeAttachment(attachment);\n    }\n    return attachment;\n  }\n\n  private reject(ws: WsLike, reason: string): void {\n    try {\n      const attachment = this.attachmentOf(ws);\n      attachment.state = 'rejected';\n      ws.serializeAttachment(attachment);\n      ws.close(1008, reason);\n    } catch {\n      // already closed or malformed attachment\n    }\n  }\n}\n","import { socketAttachment } from './ws-attachment';\nimport { WsMessageQueue, assertBroadcastCommandFits } from '@velajs/vela/websocket';\nimport type { BroadcastCommand, WsDispatcher } from '@velajs/vela/websocket';\nimport type { CfRoomRegistry } from './cf-room-registry';\nimport {\n  MAX_WS_ATTACHMENT_BYTES,\n  type DoStateLike,\n  type WsAttachment,\n  type WsLike,\n} from './do-state';\nimport { connTag, roomTag } from './room-id';\n\nexport interface WsConnectionPrincipal {\n  issuer: string;\n  subject: string;\n  principalType: 'user' | 'service';\n  tenantId: string;\n}\n\n/**\n * The socket lifecycle inside a WebSocket Durable Object, decoupled from the\n * `cloudflare:workers` base class so it is unit-testable with fakes. The thin\n * `VelaWebSocketDurableObject` shell forwards its hibernation callbacks here.\n */\nexport class DoWebSocketHost {\n  readonly #messages = new WeakMap<WsLike, WsMessageQueue>();\n  constructor(\n    private readonly ctx: DoStateLike,\n    private readonly dispatcher: WsDispatcher,\n    private readonly registry: CfRoomRegistry,\n    private readonly gatewayPaths: readonly string[] = [],\n  ) {}\n\n  /** The single registered gateway's path — a fallback when the Worker didn't forward `x-vela-path`. */\n  defaultPath(): string | undefined {\n    return this.gatewayPaths[0];\n  }\n\n  /**\n   * Accept a hibernatable socket: tag it with its hub room + connection id,\n   * persist the attachment, then await `OnGatewayConnection` before the caller\n   * returns 101. A rejected lifecycle hook closes and fails the upgrade.\n   */\n  async accept(\n    ws: WsLike,\n    path: string,\n    roomId: string,\n    userId?: string,\n    expiresAtMs?: number,\n    principal?: WsConnectionPrincipal,\n  ): Promise<boolean> {\n    const maxFrameBytes = this.dispatcher.getGatewayMaxFrameBytes(path);\n    if (maxFrameBytes === undefined) return false;\n    if (\n      expiresAtMs !== undefined &&\n      (!Number.isSafeInteger(expiresAtMs) || expiresAtMs <= Date.now())\n    ) {\n      return false;\n    }\n    if (\n      (principal !== undefined &&\n        (expiresAtMs === undefined ||\n          userId !== principal.subject ||\n          !principal.issuer ||\n          !principal.tenantId)) ||\n      (expiresAtMs !== undefined && principal === undefined)\n    ) {\n      return false;\n    }\n\n    const connId = crypto.randomUUID();\n    const attachment: WsAttachment = {\n      version: 1,\n      connId,\n      state: 'pending',\n      userId,\n      principal:\n        principal === undefined\n          ? undefined\n          : {\n              issuer: principal.issuer,\n              subject: principal.subject,\n              principalType: principal.principalType,\n            },\n      tenantId: principal?.tenantId,\n      expiresAtMs,\n      path,\n      maxFrameBytes,\n      rooms: [roomId],\n      data: {\n        ...(userId ? { userId } : {}),\n        ...(principal\n          ? {\n              principal: {\n                issuer: principal.issuer,\n                subject: principal.subject,\n                principalType: principal.principalType,\n              },\n              tenantId: principal.tenantId,\n            }\n          : {}),\n        ...(expiresAtMs !== undefined ? { expiresAtMs } : {}),\n      },\n    };\n    if (new TextEncoder().encode(JSON.stringify(attachment)).byteLength > MAX_WS_ATTACHMENT_BYTES) {\n      return false;\n    }\n    try {\n      this.ctx.acceptWebSocket(ws, [roomTag(roomId), connTag(connId)]);\n      ws.serializeAttachment(attachment);\n    } catch {\n      try {\n        ws.close(1008, 'Connection rejected');\n      } catch {\n        // already closed\n      }\n      return false;\n    }\n\n    const client = this.registry.clientFor(ws);\n    try {\n      // Broadcasts the hook issues skip this still-pending socket.\n      await this.registry.admitting(ws, () => this.dispatcher.handleOpen(path, client));\n      // Another callback may have rejected the socket while the asynchronous\n      // connection hook was still pending. Never resurrect that terminal state\n      // after the hook resolves.\n      if (!this.transition(ws, 'active', 'pending')) {\n        throw new Error(\n          socketAttachment(ws)?.state === 'rejected'\n            ? 'WebSocket was rejected while OnGatewayConnection was running: a frame ' +\n                'arrived before the connection hook completed, or the connection closed or failed'\n            : 'Unable to persist authorized WebSocket state',\n        );\n      }\n      return true;\n    } catch (err) {\n      await this.dispatcher.handleError(path, client, err).catch(() => {});\n      this.transition(ws, 'rejected');\n      try {\n        ws.close(1008, 'Connection rejected');\n      } catch {\n        // already closed\n      }\n      return false;\n    }\n  }\n\n  async onMessage(ws: WsLike, message: string | ArrayBuffer): Promise<void> {\n    if (!this.isActive(ws)) {\n      this.reject(ws, 'Connection is not authorized');\n      return;\n    }\n    let queue = this.#messages.get(ws);\n    if (!queue) {\n      const path = socketAttachment(ws)?.path;\n      const options = this.dispatcher.collectEntrypoints().find((entry) => entry.meta.path === path)\n        ?.meta.options;\n      queue = new WsMessageQueue(\n        () => this.reject(ws, 'WebSocket message budget exceeded', 1013),\n        options?.maxPendingMessages,\n        options?.maxPendingBytes,\n      );\n      this.#messages.set(ws, queue);\n    }\n    await queue.run(message, async () => {\n      if (!this.isActive(ws)) return;\n      const client = this.registry.clientFor(ws);\n      await this.dispatcher.dispatchMessage(client.path, client, message);\n    });\n  }\n\n  async onClose(ws: WsLike, code: number, reason: string): Promise<void> {\n    this.#messages.get(ws)?.stop();\n    if (!this.isActive(ws, false)) {\n      this.transition(ws, 'rejected');\n      try {\n        ws.close();\n      } catch {\n        // already closed\n      }\n      return;\n    }\n    const client = this.registry.clientFor(ws);\n    await this.dispatcher.handleClose(client.path, client, code, reason);\n    // Complete the closing handshake. Only 1000 and 3000-4999 are valid for\n    // close(); reserved/abnormal codes (1005/1006/1015, etc.) throw a RangeError,\n    // so fall back to a codeless close on those.\n    try {\n      if (code === 1000 || (code >= 3000 && code <= 4999)) ws.close(code, reason);\n      else ws.close();\n    } catch {\n      // socket already closed\n    }\n  }\n\n  async onError(ws: WsLike, err: unknown): Promise<void> {\n    if (!this.isActive(ws, false)) {\n      this.reject(ws, 'Connection failed before authorization');\n      return;\n    }\n    const client = this.registry.clientFor(ws);\n    await this.dispatcher.handleError(client.path, client, err);\n  }\n\n  /** Deliver a broadcast command to this DO's local sockets (RPC entry point). */\n  broadcast(cmd: BroadcastCommand): void | Promise<void> {\n    assertBroadcastCommandFits(cmd, this.dispatcher.getMaximumGatewayFrameBytes());\n    return this.registry.deliverLocal(cmd);\n  }\n\n  private transition(\n    ws: WsLike,\n    state: WsAttachment['state'],\n    expectedState?: WsAttachment['state'],\n  ): boolean {\n    try {\n      const attachment = socketAttachment(ws);\n      if (!attachment) return false;\n      if (expectedState !== undefined && attachment.state !== expectedState) return false;\n      attachment.state = state;\n      ws.serializeAttachment(attachment);\n      return true;\n    } catch {\n      return false;\n    }\n  }\n\n  private isActive(ws: WsLike, checkExpiry = true): boolean {\n    try {\n      const attachment = socketAttachment(ws);\n      if (!attachment || attachment.state !== 'active') return false;\n      return (\n        !checkExpiry ||\n        attachment.expiresAtMs === undefined ||\n        (Number.isSafeInteger(attachment.expiresAtMs) && attachment.expiresAtMs > Date.now())\n      );\n    } catch {\n      return false;\n    }\n  }\n\n  private reject(ws: WsLike, reason: string, code = 1008): void {\n    this.#messages.get(ws)?.stop();\n    this.transition(ws, 'rejected');\n    try {\n      ws.close(code, reason);\n    } catch {\n      // already closed\n    }\n  }\n}\n","import { bootstrap, VelaApplication } from '@velajs/vela';\nimport type { DynamicModule, Type, VelaEnv } from '@velajs/vela';\nimport {\n  local,\n  readWsEntrypointMeta,\n  WsDispatcher,\n  WsServerImpl,\n  WS_SERVER,\n} from '@velajs/vela/websocket';\nimport type { WsServer } from '@velajs/vela/websocket';\nimport type { LiveEngine } from '@velajs/vela/live';\nimport { registerCloudflareEnvironment } from '../environment';\nimport { CfWsClient } from './cf-ws-client';\nimport { CfRoomRegistry } from './cf-room-registry';\nimport { initDoLive, initializeDoLiveResources } from './do-live';\nimport type { DoStateLike } from './do-state';\nimport { WsServerHolder } from './ws-server-holder';\n\nexport interface DoRuntime {\n  dispatcher: WsDispatcher;\n  registry: CfRoomRegistry;\n  server: WsServer;\n  /** Gateway paths from `app.entrypoints.ofKind('websocket')` (discovery order). */\n  gatewayPaths: string[];\n  /** The live-query engine (undefined when the app doesn't import LiveModule). */\n  live?: LiveEngine;\n  close(signal?: string): Promise<void>;\n}\n\n/**\n * Slim DI bootstrap for the Durable Object isolate: wires the container and runs\n * `OnModuleInit`/`OnApplicationBootstrap` (so `WsDispatcher` discovers gateways)\n * WITHOUT building the Hono app/routes the DO never serves. The DO's `env` is\n * seeded as the global ENV before providers construct, and the ctx-backed server\n * is bound before bootstrap lifecycle so gateway `afterInit`/handlers see it.\n */\nexport async function buildDoRuntime(\n  rootModule: Type | DynamicModule,\n  ctx: DoStateLike,\n  options: { env: VelaEnv },\n): Promise<DoRuntime> {\n  const { container, routeManager, loader } = await bootstrap(rootModule, {\n    configureContainer: (container) => {\n      registerCloudflareEnvironment(container, options.env);\n    },\n  });\n\n  const registry = new CfRoomRegistry(ctx);\n  const driver = local();\n  driver.bind(registry);\n  const server = new WsServerImpl(driver);\n\n  if (container.has(WS_SERVER)) {\n    const holder = await container.resolveAsync(WS_SERVER);\n    // The core WebSocketModule's server broadcasts through its own sync driver,\n    // which never reaches this Durable Object's hibernatable sockets.\n    if (!(holder instanceof WsServerHolder)) {\n      throw new Error(\n        '[vela] The WebSocket Durable Object found a WS_SERVER from the core WebSocketModule, ' +\n          'which cannot reach Durable Object sockets. On Cloudflare, import ' +\n          'CloudflareWebSocketModule.forRoot() instead of WebSocketModule.forRoot().',\n      );\n    }\n    holder.setTarget(server);\n  }\n\n  const app = new VelaApplication(container, routeManager);\n  app.setInstances(await loader.resolveAllInstances());\n  initializeDoLiveResources(container, ctx);\n  await app.callOnModuleInit();\n  await app.callOnApplicationBootstrap();\n\n  // The entrypoint registry is the transport contract: one 'websocket' entry\n  // per discovered gateway ({ meta: { path, dispatcher } }). Built by\n  // callOnApplicationBootstrap(), so this slim no-routes path has it too.\n  const wsEntrypoints = app.entrypoints.ofKind('websocket', readWsEntrypointMeta);\n  const dispatcher = wsEntrypoints[0]?.meta.dispatcher ?? app.get(WsDispatcher);\n  registry.setSendPolicyResolver(\n    (path) => wsEntrypoints.find((entry) => entry.meta.path === path)?.meta.options.sendPolicy,\n  );\n  registry.setFrameLimitResolver((path) => dispatcher.getGatewayMaxFrameBytes(path));\n  registry.setDeliveryAuthorizer((client) => {\n    const path = client instanceof CfWsClient ? client.path : '';\n    return dispatcher.authorizeDelivery(path, client);\n  });\n\n  // Live queries: wire the SQLite cursor log + local driver mode and replay\n  // hibernation-persisted subscriptions into the fresh engine.\n  const live = initDoLive(app, ctx, registry);\n\n  return {\n    // Zero gateways still yields a live dispatcher (module imported, nothing\n    // decorated) — fall back to resolving it directly.\n    dispatcher,\n    registry,\n    server,\n    gatewayPaths: wsEntrypoints.map((ep) => ep.meta.path),\n    live,\n    close: (signal?: string) => app.close(signal),\n  };\n}\n","import { DurableObject } from 'cloudflare:workers';\nimport type { VelaEnv } from '@velajs/vela';\nimport type { BroadcastCommand } from '@velajs/vela/websocket';\nimport type {\n  CommitStamp,\n  InvalidationCommand,\n  LiveEngine,\n  LiveInspection,\n} from '@velajs/vela/live';\nimport { buildDoRuntime } from './do-bootstrap';\nimport { DoWebSocketHost, type WsConnectionPrincipal } from './do-websocket-host';\nimport { armDoPitr, readDoPitrBookmark } from './do-pitr';\nimport type { CloudflareRoot } from '../root-module';\nimport type {\n  DoPitrArmOptions,\n  DoPitrArmResult,\n  DoPitrBookmarkRead,\n  VelaDoPitrRpc,\n} from './do-pitr';\n\nconst PING = '{\"event\":\"$ping\"}';\nconst PONG = '{\"event\":\"$pong\"}';\nconst MAX_IDENTITY_FIELD_BYTES = 2048;\nconst encoder = new TextEncoder();\n\nfunction isIdentityField(value: string | null): value is string {\n  return (\n    value !== null &&\n    value.length > 0 &&\n    encoder.encode(value).byteLength <= MAX_IDENTITY_FIELD_BYTES\n  );\n}\n\n/**\n * Base class for the WebSocket Durable Object. The user exports a named subclass\n * (matching their `wrangler.toml` `class_name`) built from their `AppModule`, or\n * from a `DynamicModule` declared at module scope:\n *\n * ```ts\n * export class ChatRoom extends VelaWebSocketDurableObject(AppModule) {}\n * ```\n *\n * It owns the raw hibernation socket lifecycle (Hono's `upgradeWebSocket` cannot\n * bridge DO hibernation) and forwards every event into the runtime-agnostic\n * `WsDispatcher` via {@link DoWebSocketHost}. The DO's `env` is the\n * application's ENV, as in the Worker.\n */\nexport function VelaWebSocketDurableObject(rootModule: CloudflareRoot): new (\n  ctx: DurableObjectState,\n  env: VelaEnv,\n) => DurableObject<VelaEnv> &\n  VelaDoPitrRpc & {\n    broadcast(cmd: BroadcastCommand): Promise<void>;\n    invalidate(cmd: InvalidationCommand): Promise<CommitStamp | undefined>;\n    inspectLive(): Promise<LiveInspection>;\n  } {\n  return class VelaWsDurableObject extends DurableObject<VelaEnv> {\n    private host!: DoWebSocketHost;\n    private liveEngine?: LiveEngine;\n    private readonly ready: Promise<void>;\n\n    constructor(ctx: DurableObjectState, env: VelaEnv) {\n      super(ctx, env);\n      // Application-level ping/pong answered WITHOUT waking a hibernated DO.\n      try {\n        ctx.setWebSocketAutoResponse(new WebSocketRequestResponsePair(PING, PONG));\n      } catch {\n        // Older runtimes without auto-response — fine, protocol pings still work.\n      }\n      this.ready = ctx.blockConcurrencyWhile(async () => {\n        // The root is static, so constructing another instance declares no new\n        // classes in the isolate-global metadata registry.\n        const runtime = await buildDoRuntime(rootModule, ctx, { env });\n        this.host = new DoWebSocketHost(\n          ctx,\n          runtime.dispatcher,\n          runtime.registry,\n          runtime.gatewayPaths,\n        );\n        this.liveEngine = runtime.live;\n      });\n    }\n\n    /** Intra-worker RPC only; HTTP fetch never exposes this admin snapshot. */\n    async inspectLive(): Promise<LiveInspection> {\n      await this.ready;\n      return this.liveEngine?.inspect() ?? { subscriptions: [], rooms: [] };\n    }\n\n    override async fetch(request: Request): Promise<Response> {\n      await this.ready;\n      if (request.headers.get('upgrade')?.toLowerCase() !== 'websocket') {\n        return new Response('Expected WebSocket upgrade', { status: 426 });\n      }\n\n      const url = new URL(request.url);\n      // Headers are primary (carry auth + multi-gateway routing); fall back to the\n      // DO's own name (set via idFromName(room)) and the single gateway path so a\n      // plain `stub.fetch(request)` forward still works.\n      const roomId = request.headers.get('x-vela-room') ?? this.ctx.id.name ?? url.pathname;\n      const path = request.headers.get('x-vela-path') ?? this.host.defaultPath() ?? url.pathname;\n      const userId = request.headers.get('x-vela-user') || undefined;\n      const rawExpiresAtMs = request.headers.get('x-vela-expires-at-ms');\n      const parsedExpiresAtMs = rawExpiresAtMs === null ? undefined : Number(rawExpiresAtMs);\n      if (\n        parsedExpiresAtMs !== undefined &&\n        (!Number.isSafeInteger(parsedExpiresAtMs) || parsedExpiresAtMs <= 0)\n      ) {\n        return new Response('Invalid WebSocket identity expiry', { status: 403 });\n      }\n\n      const issuer = request.headers.get('x-vela-issuer');\n      const subject = request.headers.get('x-vela-subject');\n      const principalType = request.headers.get('x-vela-principal-type');\n      const tenantId = request.headers.get('x-vela-tenant');\n      const hasPrincipalHeader =\n        issuer !== null || subject !== null || principalType !== null || tenantId !== null;\n      let principal: WsConnectionPrincipal | undefined;\n      if (hasPrincipalHeader) {\n        if (\n          !isIdentityField(issuer) ||\n          !isIdentityField(subject) ||\n          (principalType !== 'user' && principalType !== 'service') ||\n          !isIdentityField(tenantId) ||\n          parsedExpiresAtMs === undefined ||\n          (userId !== undefined && userId !== subject)\n        ) {\n          return new Response('Invalid WebSocket principal', { status: 403 });\n        }\n        principal = { issuer, subject, principalType, tenantId };\n      } else if (parsedExpiresAtMs !== undefined) {\n        return new Response('WebSocket identity tuple is missing', { status: 403 });\n      }\n\n      if (parsedExpiresAtMs !== undefined && parsedExpiresAtMs <= Date.now()) {\n        return new Response('WebSocket identity expired', { status: 403 });\n      }\n\n      const { 0: client, 1: server } = new WebSocketPair();\n      const accepted = await this.host.accept(\n        server,\n        path,\n        roomId,\n        userId,\n        parsedExpiresAtMs,\n        principal,\n      );\n      if (!accepted) return new Response('WebSocket connection rejected', { status: 403 });\n      return new Response(null, { status: 101, webSocket: client });\n    }\n\n    override async webSocketMessage(ws: WebSocket, message: string | ArrayBuffer): Promise<void> {\n      await this.ready;\n      await this.host.onMessage(ws, message);\n    }\n\n    override async webSocketClose(ws: WebSocket, code: number, reason: string): Promise<void> {\n      await this.ready;\n      await this.host.onClose(ws, code, reason);\n    }\n\n    override async webSocketError(ws: WebSocket, error: unknown): Promise<void> {\n      await this.ready;\n      await this.host.onError(ws, error);\n    }\n\n    /** DO RPC — server-initiated broadcast forwarded from a Worker (see `broadcastToRoom`). */\n    async broadcast(cmd: BroadcastCommand): Promise<void> {\n      await this.ready;\n      await this.host.broadcast(cmd);\n    }\n\n    /**\n     * DO RPC — live tag invalidation forwarded from a Worker (durableObjectLive /\n     * liveInvalidateToRoom). Appends to THIS log scope's cursor log and returns\n     * the commit stamp (what `Vela-Commit-Cursor` carries); the subscription\n     * refreshes fan out asynchronously.\n     */\n    async invalidate(cmd: InvalidationCommand): Promise<CommitStamp | undefined> {\n      await this.ready;\n      return this.liveEngine?.applyInvalidation(cmd);\n    }\n\n    // -- Durable Object PITR (point-in-time recovery) RPC ---------------------\n    //\n    // GUARD / reachability: these are admin-privileged operations (a restore can\n    // roll the DO's SQLite state back up to 30 days and, with `restart`, abort\n    // the DO to apply it now). They are safe to expose here because a Durable\n    // Object's RPC methods are NOT network-reachable: a `DurableObjectStub` is\n    // obtainable ONLY from a Worker that binds this DO namespace, and RPC calls\n    // travel Cloudflare's internal capability channel — never the public\n    // internet. A WebSocket/HTTP client reaches only `fetch()` above, never these\n    // methods. The security boundary is therefore the WORKER-SIDE studio admin\n    // gate that fronts the `CloudflareDoTimeTravelPort` (master admin token + the\n    // 428 confirm challenge) — the identical trust model as `broadcast()` /\n    // `invalidate()` on this same DO. See `do-pitr.ts` for the storage wrappers.\n\n    /** DO RPC — the current PITR bookmark (typed-unavailable on a non-SQLite DO). */\n    async pitrCurrentBookmark(): Promise<DoPitrBookmarkRead> {\n      await this.ready;\n      return readDoPitrBookmark(this.ctx.storage);\n    }\n\n    /** DO RPC — the PITR bookmark closest to `time` (+ the current bookmark). */\n    async pitrBookmarkForTime(time: number | string): Promise<DoPitrBookmarkRead> {\n      await this.ready;\n      return readDoPitrBookmark(this.ctx.storage, time);\n    }\n\n    /**\n     * DO RPC — arm a PITR restore and return the undo bookmark. When `restart` is\n     * requested, `ctx.abort()` is called AFTER the undo bookmark is computed so\n     * the recovery applies on the immediately-following session; otherwise the\n     * restore applies on the next natural restart (`restarted: false`).\n     */\n    async pitrArmRestore(opts: DoPitrArmOptions): Promise<DoPitrArmResult> {\n      await this.ready;\n      const result = await armDoPitr(this.ctx.storage, opts);\n      if (opts.restart === true) this.ctx.abort('vela PITR restore');\n      return result;\n    }\n  };\n}\n","import { DurableObject } from 'cloudflare:workers';\nimport { MAX_NONCE_BYTES, isCanonicalBoundedText, isValidExpiry } from './nonce-validation';\nconst EXPIRED_DELETE_BATCH = 1_024;\n\nconst CREATE_TABLE =\n  'CREATE TABLE IF NOT EXISTS __vela_nonce_claims (' +\n  'nonce TEXT PRIMARY KEY NOT NULL, ' +\n  'expires_at INTEGER NOT NULL CHECK (expires_at > 0)' +\n  ') WITHOUT ROWID';\nconst CREATE_EXPIRY_INDEX =\n  'CREATE INDEX IF NOT EXISTS __vela_nonce_claims_expiry ON __vela_nonce_claims (expires_at)';\nconst DELETE_EXPIRED =\n  'DELETE FROM __vela_nonce_claims WHERE nonce IN (' +\n  'SELECT nonce FROM __vela_nonce_claims ' +\n  'WHERE expires_at < ? ORDER BY expires_at LIMIT ?' +\n  ')';\nconst INSERT_CLAIM =\n  'INSERT INTO __vela_nonce_claims (nonce, expires_at) VALUES (?, ?) ' +\n  'ON CONFLICT(nonce) DO NOTHING RETURNING nonce, expires_at';\n\ninterface NonceSqlCursor {\n  toArray(): Record<string, unknown>[];\n}\n\ninterface NonceSqlStorage {\n  exec(query: string, ...bindings: unknown[]): NonceSqlCursor;\n}\n\n/**\n * SQLite Durable Object that atomically consumes nonces.\n *\n * Export this class from the Worker entry and register it through a Wrangler\n * `new_sqlite_classes` migration. `INSERT ... ON CONFLICT DO NOTHING RETURNING`\n * is the single-use decision; all SQL runs synchronously before the RPC method\n * yields, and the nonce primary key is the final concurrency boundary.\n */\nexport class VelaNonceDurableObject extends DurableObject<Record<string, unknown>> {\n  private sql?: NonceSqlStorage;\n\n  constructor(ctx: DurableObjectState, env: Record<string, unknown>) {\n    super(ctx, env);\n    try {\n      const sql = ctx.storage?.sql;\n      if (!sql || typeof sql.exec !== 'function') return;\n      sql.exec(CREATE_TABLE);\n      sql.exec(CREATE_EXPIRY_INDEX);\n      this.sql = sql;\n    } catch {\n      // A non-SQLite/misconfigured class stays fail-closed: every claim denies.\n      this.sql = undefined;\n    }\n  }\n\n  async claim(nonce: string, expEpochSeconds: number): Promise<boolean> {\n    const sql = this.sql;\n    if (!sql) return false;\n\n    const now = Math.floor(Date.now() / 1_000);\n    if (!isCanonicalBoundedText(nonce, MAX_NONCE_BYTES) || !isValidExpiry(expEpochSeconds, now)) {\n      return false;\n    }\n\n    try {\n      // Keep cleanup bounded so one claim cannot monopolize the DO. Entries at\n      // exactly `now` remain: Vela's invocation verifier accepts `now === exp`.\n      sql.exec(DELETE_EXPIRED, now, EXPIRED_DELETE_BATCH);\n\n      const cursor = sql.exec(INSERT_CLAIM, nonce, expEpochSeconds);\n      if (!cursor || typeof cursor.toArray !== 'function') return false;\n      const rows: unknown = cursor.toArray();\n      if (!Array.isArray(rows) || rows.length !== 1) return false;\n\n      const row: unknown = rows[0];\n      if (typeof row !== 'object' || row === null) return false;\n      if (\n        !Object.hasOwn(row, 'nonce') ||\n        !Object.hasOwn(row, 'expires_at') ||\n        !('nonce' in row) ||\n        !('expires_at' in row)\n      ) {\n        return false;\n      }\n      return row.nonce === nonce && row.expires_at === expEpochSeconds;\n    } catch {\n      return false;\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;;AAYA,IAAa,iBAAb,MAAoD;CAerB;CAd7B,6BAAsB,IAAI,QAAmC;CAI7D,6BAAsB,IAAI,QAAgB;CAC1C;CAEA,sBAAsB,SAAkE;EACtF,KAAK,qBAAqB;CAC5B;CAEA;CACA;CAEA,YAAY,KAAmC;EAAlB,KAAA,MAAA;CAAmB;CAEhD,sBAAsB,YAAoE;EACxF,KAAK,qBAAqB;CAC5B;;CAGA,sBAAsB,UAAsD;EAC1E,KAAK,oBAAoB;CAC3B;;;;;;CAOA,MAAM,UAAa,IAAY,OAAqC;EAClE,KAAK,WAAW,IAAI,EAAE;EACtB,IAAI;GACF,OAAO,MAAM,MAAM;EACrB,UAAU;GACR,KAAK,WAAW,OAAO,EAAE;EAC3B;CACF;CAGA,SAAS,SAAyB,CAAC;CACnC,SAAS,SAAyB,CAAC;CAEnC,KAAK,QAAkB,MAAoC;EACzD,OAAO,OAAO,KAAK,IAAI;CACzB;CAEA,MAAM,QAAkB,MAAoC;EAC1D,OAAO,OAAO,MAAM,IAAI;CAC1B;CAEA,eAAe,MAAwB;EACrC,OAAO,KAAK,eAAe,IAAI,CAAC,CAAC,KAAK,OAAO,KAAK,aAAa,EAAE,CAAC,CAAC,MAAM;CAC3E;CAEA,aAAa,KAA6C;EACxD,MAAM,aAAa,IAAI,IAAI,IAAI,aAAa,CAAC,CAAC;EAC9C,MAAM,eAAe,IAAI,eAAe,CAAC;EAIzC,MAAM,UACJ,IAAI,MAAM,WAAW,IAAI,KAAK,IAAI,cAAc,IAAI,KAAK,aAAa,IAAI,KAAK;EAEjF,MAAM,uBAAO,IAAI,IAAY;EAC7B,MAAM,WAAoD,CAAC;EAC3D,KAAK,MAAM,MAAM,SAAS;GACxB,MAAM,MAAM,KAAK,oBAAoB,IAAI,KAAK,aAAa,EAAE,CAAC;GAK9D,IAAI,IAAI,UAAU,aAAa,KAAK,WAAW,IAAI,EAAE,GAAG;GACxD,IACE,IAAI,UAAU,YACb,IAAI,gBAAgB,KAAA,MAClB,CAAC,OAAO,cAAc,IAAI,WAAW,KAAK,IAAI,eAAe,KAAK,IAAI,IACzE;IACA,IAAI;KACF,IAAI,QAAQ;KACZ,GAAG,oBAAoB,GAAG;KAC1B,GAAG,MAAM,MAAM,yCAAyC;IAC1D,QAAQ,CAER;IACA;GACF;GACA,IAAI,KAAK,IAAI,IAAI,MAAM,GAAG;GAC1B,KAAK,IAAI,IAAI,MAAM;GACnB,IAAI,WAAW,IAAI,IAAI,MAAM,GAAG;GAChC,IAAI,aAAa,MAAM,MAAM,IAAI,MAAM,SAAS,CAAC,CAAC,GAAG;GACrD,SAAS,KAAK;IAAE;IAAI,QAAQ,KAAK,UAAU,EAAE;GAAE,CAAC;EAClD;EAEA,IAAI,CAAC,KAAK,oBAAoB;GAC5B,KAAK,MAAM,EAAE,YAAY,UAAU,OAAO,QAAQ,IAAI,KAAK;GAC3D;EACF;EACA,OAAO,QAAQ,IACb,SAAS,IAAI,OAAO,EAAE,IAAI,aAAa;GACrC,IAAI,UAAU;GACd,IAAI;IACF,UAAW,MAAM,KAAK,mBAAoB,MAAM,MAAO;GACzD,QAAQ;IACN,UAAU;GACZ;GACA,IAAI,SAAS,OAAO,QAAQ,IAAI,KAAK;QAChC,KAAK,OAAO,IAAI,gCAAgC;EACvD,CAAC,CACH,CAAC,CAAC,WAAW,KAAA,CAAS;CACxB;CAEA,aAAqB,OAA2B;EAC9C,MAAM,sBAAM,IAAI,IAAY;EAC5B,KAAK,MAAM,QAAQ,OAAO,KAAK,MAAM,MAAM,KAAK,eAAe,IAAI,GAAG,IAAI,IAAI,EAAE;EAChF,OAAO,CAAC,GAAG,GAAG;CAChB;CAEA,eAAuB,MAAwB;EAK7C,OAAO,KAAK,IAAI,cAAc,CAAC,CAAC,QAAQ,OAAO,KAAK,aAAa,EAAE,CAAC,CAAC,MAAM,SAAS,IAAI,CAAC;CAC3F;CAEA,aAAqB,IAA0B;EAC7C,OAAO,iBAAiB,EAAE,KAAK,mBAAmB;CACpD;;CAGA,UAAU,IAAwB;EAChC,KAAK,oBAAoB,IAAI,KAAK,aAAa,EAAE,CAAC;EAClD,IAAI,OAAO,KAAK,WAAW,IAAI,EAAE;EACjC,IAAI,CAAC,MAAM;GACT,OAAO,IAAI,kBAAkB,KAAK,qBAAqB,KAAK,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC;GAClF,KAAK,WAAW,IAAI,IAAI,IAAI;EAC9B;EACA,OAAO,IAAI,WAAW,KAAK,KAAK,IAAI,IAAI;CAC1C;CAEA,oBAA4B,IAAY,YAAwC;EAC9E,MAAM,WAAW,KAAK,oBAAoB,WAAW,IAAI;EACzD,IAAI,aAAa,KAAA,KAAa,WAAW,kBAAkB,UAAU;GACnE,WAAW,gBAAgB;GAC3B,GAAG,oBAAoB,UAAU;EACnC;EACA,OAAO;CACT;CAEA,OAAe,IAAY,QAAsB;EAC/C,IAAI;GACF,MAAM,aAAa,KAAK,aAAa,EAAE;GACvC,WAAW,QAAQ;GACnB,GAAG,oBAAoB,UAAU;GACjC,GAAG,MAAM,MAAM,MAAM;EACvB,QAAQ,CAER;CACF;AACF;;;;;;;;ACrJA,IAAa,kBAAb,MAA6B;CAGR;CACA;CACA;CACA;CALnB,4BAAqB,IAAI,QAAgC;CACzD,YACE,KACA,YACA,UACA,eAAmD,CAAC,GACpD;EAJiB,KAAA,MAAA;EACA,KAAA,aAAA;EACA,KAAA,WAAA;EACA,KAAA,eAAA;CAChB;;CAGH,cAAkC;EAChC,OAAO,KAAK,aAAa;CAC3B;;;;;;CAOA,MAAM,OACJ,IACA,MACA,QACA,QACA,aACA,WACkB;EAClB,MAAM,gBAAgB,KAAK,WAAW,wBAAwB,IAAI;EAClE,IAAI,kBAAkB,KAAA,GAAW,OAAO;EACxC,IACE,gBAAgB,KAAA,MACf,CAAC,OAAO,cAAc,WAAW,KAAK,eAAe,KAAK,IAAI,IAE/D,OAAO;EAET,IACG,cAAc,KAAA,MACZ,gBAAgB,KAAA,KACf,WAAW,UAAU,WACrB,CAAC,UAAU,UACX,CAAC,UAAU,aACd,gBAAgB,KAAA,KAAa,cAAc,KAAA,GAE5C,OAAO;EAGT,MAAM,SAAS,OAAO,WAAW;EACjC,MAAM,aAA2B;GAC/B,SAAS;GACT;GACA,OAAO;GACP;GACA,WACE,cAAc,KAAA,IACV,KAAA,IACA;IACE,QAAQ,UAAU;IAClB,SAAS,UAAU;IACnB,eAAe,UAAU;GAC3B;GACN,UAAU,WAAW;GACrB;GACA;GACA;GACA,OAAO,CAAC,MAAM;GACd,MAAM;IACJ,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;IAC3B,GAAI,YACA;KACE,WAAW;MACT,QAAQ,UAAU;MAClB,SAAS,UAAU;MACnB,eAAe,UAAU;KAC3B;KACA,UAAU,UAAU;IACtB,IACA,CAAC;IACL,GAAI,gBAAgB,KAAA,IAAY,EAAE,YAAY,IAAI,CAAC;GACrD;EACF;EACA,IAAI,IAAI,YAAY,CAAC,CAAC,OAAO,KAAK,UAAU,UAAU,CAAC,CAAC,CAAC,aAAA,OACvD,OAAO;EAET,IAAI;GACF,KAAK,IAAI,gBAAgB,IAAI,CAAC,QAAQ,MAAM,GAAG,QAAQ,MAAM,CAAC,CAAC;GAC/D,GAAG,oBAAoB,UAAU;EACnC,QAAQ;GACN,IAAI;IACF,GAAG,MAAM,MAAM,qBAAqB;GACtC,QAAQ,CAER;GACA,OAAO;EACT;EAEA,MAAM,SAAS,KAAK,SAAS,UAAU,EAAE;EACzC,IAAI;GAEF,MAAM,KAAK,SAAS,UAAU,UAAU,KAAK,WAAW,WAAW,MAAM,MAAM,CAAC;GAIhF,IAAI,CAAC,KAAK,WAAW,IAAI,UAAU,SAAS,GAC1C,MAAM,IAAI,MACR,iBAAiB,EAAE,CAAC,EAAE,UAAU,aAC5B,2JAEA,8CACN;GAEF,OAAO;EACT,SAAS,KAAK;GACZ,MAAM,KAAK,WAAW,YAAY,MAAM,QAAQ,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC;GACnE,KAAK,WAAW,IAAI,UAAU;GAC9B,IAAI;IACF,GAAG,MAAM,MAAM,qBAAqB;GACtC,QAAQ,CAER;GACA,OAAO;EACT;CACF;CAEA,MAAM,UAAU,IAAY,SAA8C;EACxE,IAAI,CAAC,KAAK,SAAS,EAAE,GAAG;GACtB,KAAK,OAAO,IAAI,8BAA8B;GAC9C;EACF;EACA,IAAI,QAAQ,KAAK,UAAU,IAAI,EAAE;EACjC,IAAI,CAAC,OAAO;GACV,MAAM,OAAO,iBAAiB,EAAE,CAAC,EAAE;GACnC,MAAM,UAAU,KAAK,WAAW,mBAAmB,CAAC,CAAC,MAAM,UAAU,MAAM,KAAK,SAAS,IAAI,CAAC,EAC1F,KAAK;GACT,QAAQ,IAAI,qBACJ,KAAK,OAAO,IAAI,qCAAqC,IAAI,GAC/D,SAAS,oBACT,SAAS,eACX;GACA,KAAK,UAAU,IAAI,IAAI,KAAK;EAC9B;EACA,MAAM,MAAM,IAAI,SAAS,YAAY;GACnC,IAAI,CAAC,KAAK,SAAS,EAAE,GAAG;GACxB,MAAM,SAAS,KAAK,SAAS,UAAU,EAAE;GACzC,MAAM,KAAK,WAAW,gBAAgB,OAAO,MAAM,QAAQ,OAAO;EACpE,CAAC;CACH;CAEA,MAAM,QAAQ,IAAY,MAAc,QAA+B;EACrE,KAAK,UAAU,IAAI,EAAE,CAAC,EAAE,KAAK;EAC7B,IAAI,CAAC,KAAK,SAAS,IAAI,KAAK,GAAG;GAC7B,KAAK,WAAW,IAAI,UAAU;GAC9B,IAAI;IACF,GAAG,MAAM;GACX,QAAQ,CAER;GACA;EACF;EACA,MAAM,SAAS,KAAK,SAAS,UAAU,EAAE;EACzC,MAAM,KAAK,WAAW,YAAY,OAAO,MAAM,QAAQ,MAAM,MAAM;EAInE,IAAI;GACF,IAAI,SAAS,OAAS,QAAQ,OAAQ,QAAQ,MAAO,GAAG,MAAM,MAAM,MAAM;QACrE,GAAG,MAAM;EAChB,QAAQ,CAER;CACF;CAEA,MAAM,QAAQ,IAAY,KAA6B;EACrD,IAAI,CAAC,KAAK,SAAS,IAAI,KAAK,GAAG;GAC7B,KAAK,OAAO,IAAI,wCAAwC;GACxD;EACF;EACA,MAAM,SAAS,KAAK,SAAS,UAAU,EAAE;EACzC,MAAM,KAAK,WAAW,YAAY,OAAO,MAAM,QAAQ,GAAG;CAC5D;;CAGA,UAAU,KAA6C;EACrD,2BAA2B,KAAK,KAAK,WAAW,4BAA4B,CAAC;EAC7E,OAAO,KAAK,SAAS,aAAa,GAAG;CACvC;CAEA,WACE,IACA,OACA,eACS;EACT,IAAI;GACF,MAAM,aAAa,iBAAiB,EAAE;GACtC,IAAI,CAAC,YAAY,OAAO;GACxB,IAAI,kBAAkB,KAAA,KAAa,WAAW,UAAU,eAAe,OAAO;GAC9E,WAAW,QAAQ;GACnB,GAAG,oBAAoB,UAAU;GACjC,OAAO;EACT,QAAQ;GACN,OAAO;EACT;CACF;CAEA,SAAiB,IAAY,cAAc,MAAe;EACxD,IAAI;GACF,MAAM,aAAa,iBAAiB,EAAE;GACtC,IAAI,CAAC,cAAc,WAAW,UAAU,UAAU,OAAO;GACzD,OACE,CAAC,eACD,WAAW,gBAAgB,KAAA,KAC1B,OAAO,cAAc,WAAW,WAAW,KAAK,WAAW,cAAc,KAAK,IAAI;EAEvF,QAAQ;GACN,OAAO;EACT;CACF;CAEA,OAAe,IAAY,QAAgB,OAAO,MAAY;EAC5D,KAAK,UAAU,IAAI,EAAE,CAAC,EAAE,KAAK;EAC7B,KAAK,WAAW,IAAI,UAAU;EAC9B,IAAI;GACF,GAAG,MAAM,MAAM,MAAM;EACvB,QAAQ,CAER;CACF;AACF;;;;;;;;;;ACtNA,eAAsB,eACpB,YACA,KACA,SACoB;CACpB,MAAM,EAAE,WAAW,cAAc,WAAW,MAAM,UAAU,YAAY,EACtE,qBAAqB,cAAc;EACjC,8BAA8B,WAAW,QAAQ,GAAG;CACtD,EACF,CAAC;CAED,MAAM,WAAW,IAAI,eAAe,GAAG;CACvC,MAAM,SAAS,MAAM;CACrB,OAAO,KAAK,QAAQ;CACpB,MAAM,SAAS,IAAI,aAAa,MAAM;CAEtC,IAAI,UAAU,IAAI,SAAS,GAAG;EAC5B,MAAM,SAAS,MAAM,UAAU,aAAa,SAAS;EAGrD,IAAI,EAAE,kBAAkB,iBACtB,MAAM,IAAI,MACR,iOAGF;EAEF,OAAO,UAAU,MAAM;CACzB;CAEA,MAAM,MAAM,IAAI,gBAAgB,WAAW,YAAY;CACvD,IAAI,aAAa,MAAM,OAAO,oBAAoB,CAAC;CACnD,0BAA0B,WAAW,GAAG;CACxC,MAAM,IAAI,iBAAiB;CAC3B,MAAM,IAAI,2BAA2B;CAKrC,MAAM,gBAAgB,IAAI,YAAY,OAAO,aAAa,oBAAoB;CAC9E,MAAM,aAAa,cAAc,EAAE,EAAE,KAAK,cAAc,IAAI,IAAI,YAAY;CAC5E,SAAS,uBACN,SAAS,cAAc,MAAM,UAAU,MAAM,KAAK,SAAS,IAAI,CAAC,EAAE,KAAK,QAAQ,UAClF;CACA,SAAS,uBAAuB,SAAS,WAAW,wBAAwB,IAAI,CAAC;CACjF,SAAS,uBAAuB,WAAW;EACzC,MAAM,OAAO,kBAAkB,aAAa,OAAO,OAAO;EAC1D,OAAO,WAAW,kBAAkB,MAAM,MAAM;CAClD,CAAC;CAID,MAAM,OAAO,WAAW,KAAK,KAAK,QAAQ;CAE1C,OAAO;EAGL;EACA;EACA;EACA,cAAc,cAAc,KAAK,OAAO,GAAG,KAAK,IAAI;EACpD;EACA,QAAQ,WAAoB,IAAI,MAAM,MAAM;CAC9C;AACF;;;AChFA,MAAM,OAAO;AACb,MAAM,OAAO;AACb,MAAM,2BAA2B;AACjC,MAAM,UAAU,IAAI,YAAY;AAEhC,SAAS,gBAAgB,OAAuC;CAC9D,OACE,UAAU,QACV,MAAM,SAAS,KACf,QAAQ,OAAO,KAAK,CAAC,CAAC,cAAc;AAExC;;;;;;;;;;;;;;;AAgBA,SAAgB,2BAA2B,YAQvC;CACF,OAAO,MAAM,4BAA4B,cAAuB;EAC9D;EACA;EACA;EAEA,YAAY,KAAyB,KAAc;GACjD,MAAM,KAAK,GAAG;GAEd,IAAI;IACF,IAAI,yBAAyB,IAAI,6BAA6B,MAAM,IAAI,CAAC;GAC3E,QAAQ,CAER;GACA,KAAK,QAAQ,IAAI,sBAAsB,YAAY;IAGjD,MAAM,UAAU,MAAM,eAAe,YAAY,KAAK,EAAE,IAAI,CAAC;IAC7D,KAAK,OAAO,IAAI,gBACd,KACA,QAAQ,YACR,QAAQ,UACR,QAAQ,YACV;IACA,KAAK,aAAa,QAAQ;GAC5B,CAAC;EACH;;EAGA,MAAM,cAAuC;GAC3C,MAAM,KAAK;GACX,OAAO,KAAK,YAAY,QAAQ,KAAK;IAAE,eAAe,CAAC;IAAG,OAAO,CAAC;GAAE;EACtE;EAEA,MAAe,MAAM,SAAqC;GACxD,MAAM,KAAK;GACX,IAAI,QAAQ,QAAQ,IAAI,SAAS,CAAC,EAAE,YAAY,MAAM,aACpD,OAAO,IAAI,SAAS,8BAA8B,EAAE,QAAQ,IAAI,CAAC;GAGnE,MAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;GAI/B,MAAM,SAAS,QAAQ,QAAQ,IAAI,aAAa,KAAK,KAAK,IAAI,GAAG,QAAQ,IAAI;GAC7E,MAAM,OAAO,QAAQ,QAAQ,IAAI,aAAa,KAAK,KAAK,KAAK,YAAY,KAAK,IAAI;GAClF,MAAM,SAAS,QAAQ,QAAQ,IAAI,aAAa,KAAK,KAAA;GACrD,MAAM,iBAAiB,QAAQ,QAAQ,IAAI,sBAAsB;GACjE,MAAM,oBAAoB,mBAAmB,OAAO,KAAA,IAAY,OAAO,cAAc;GACrF,IACE,sBAAsB,KAAA,MACrB,CAAC,OAAO,cAAc,iBAAiB,KAAK,qBAAqB,IAElE,OAAO,IAAI,SAAS,qCAAqC,EAAE,QAAQ,IAAI,CAAC;GAG1E,MAAM,SAAS,QAAQ,QAAQ,IAAI,eAAe;GAClD,MAAM,UAAU,QAAQ,QAAQ,IAAI,gBAAgB;GACpD,MAAM,gBAAgB,QAAQ,QAAQ,IAAI,uBAAuB;GACjE,MAAM,WAAW,QAAQ,QAAQ,IAAI,eAAe;GACpD,MAAM,qBACJ,WAAW,QAAQ,YAAY,QAAQ,kBAAkB,QAAQ,aAAa;GAChF,IAAI;GACJ,IAAI,oBAAoB;IACtB,IACE,CAAC,gBAAgB,MAAM,KACvB,CAAC,gBAAgB,OAAO,KACvB,kBAAkB,UAAU,kBAAkB,aAC/C,CAAC,gBAAgB,QAAQ,KACzB,sBAAsB,KAAA,KACrB,WAAW,KAAA,KAAa,WAAW,SAEpC,OAAO,IAAI,SAAS,+BAA+B,EAAE,QAAQ,IAAI,CAAC;IAEpE,YAAY;KAAE;KAAQ;KAAS;KAAe;IAAS;GACzD,OAAO,IAAI,sBAAsB,KAAA,GAC/B,OAAO,IAAI,SAAS,uCAAuC,EAAE,QAAQ,IAAI,CAAC;GAG5E,IAAI,sBAAsB,KAAA,KAAa,qBAAqB,KAAK,IAAI,GACnE,OAAO,IAAI,SAAS,8BAA8B,EAAE,QAAQ,IAAI,CAAC;GAGnE,MAAM,EAAE,GAAG,QAAQ,GAAG,WAAW,IAAI,cAAc;GASnD,IAAI,CAAC,MARkB,KAAK,KAAK,OAC/B,QACA,MACA,QACA,QACA,mBACA,SACF,GACe,OAAO,IAAI,SAAS,iCAAiC,EAAE,QAAQ,IAAI,CAAC;GACnF,OAAO,IAAI,SAAS,MAAM;IAAE,QAAQ;IAAK,WAAW;GAAO,CAAC;EAC9D;EAEA,MAAe,iBAAiB,IAAe,SAA8C;GAC3F,MAAM,KAAK;GACX,MAAM,KAAK,KAAK,UAAU,IAAI,OAAO;EACvC;EAEA,MAAe,eAAe,IAAe,MAAc,QAA+B;GACxF,MAAM,KAAK;GACX,MAAM,KAAK,KAAK,QAAQ,IAAI,MAAM,MAAM;EAC1C;EAEA,MAAe,eAAe,IAAe,OAA+B;GAC1E,MAAM,KAAK;GACX,MAAM,KAAK,KAAK,QAAQ,IAAI,KAAK;EACnC;;EAGA,MAAM,UAAU,KAAsC;GACpD,MAAM,KAAK;GACX,MAAM,KAAK,KAAK,UAAU,GAAG;EAC/B;;;;;;;EAQA,MAAM,WAAW,KAA4D;GAC3E,MAAM,KAAK;GACX,OAAO,KAAK,YAAY,kBAAkB,GAAG;EAC/C;;EAiBA,MAAM,sBAAmD;GACvD,MAAM,KAAK;GACX,OAAO,mBAAmB,KAAK,IAAI,OAAO;EAC5C;;EAGA,MAAM,oBAAoB,MAAoD;GAC5E,MAAM,KAAK;GACX,OAAO,mBAAmB,KAAK,IAAI,SAAS,IAAI;EAClD;;;;;;;EAQA,MAAM,eAAe,MAAkD;GACrE,MAAM,KAAK;GACX,MAAM,SAAS,MAAM,UAAU,KAAK,IAAI,SAAS,IAAI;GACrD,IAAI,KAAK,YAAY,MAAM,KAAK,IAAI,MAAM,mBAAmB;GAC7D,OAAO;EACT;CACF;AACF;;;AC5NA,MAAM,uBAAuB;AAE7B,MAAM,eACJ;AAIF,MAAM,sBACJ;AACF,MAAM,iBACJ;AAIF,MAAM,eACJ;;;;;;;;;AAmBF,IAAa,yBAAb,cAA4C,cAAuC;CACjF;CAEA,YAAY,KAAyB,KAA8B;EACjE,MAAM,KAAK,GAAG;EACd,IAAI;GACF,MAAM,MAAM,IAAI,SAAS;GACzB,IAAI,CAAC,OAAO,OAAO,IAAI,SAAS,YAAY;GAC5C,IAAI,KAAK,YAAY;GACrB,IAAI,KAAK,mBAAmB;GAC5B,KAAK,MAAM;EACb,QAAQ;GAEN,KAAK,MAAM,KAAA;EACb;CACF;CAEA,MAAM,MAAM,OAAe,iBAA2C;EACpE,MAAM,MAAM,KAAK;EACjB,IAAI,CAAC,KAAK,OAAO;EAEjB,MAAM,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAK;EACzC,IAAI,CAAC,uBAAuB,OAAA,GAAsB,KAAK,CAAC,cAAc,iBAAiB,GAAG,GACxF,OAAO;EAGT,IAAI;GAGF,IAAI,KAAK,gBAAgB,KAAK,oBAAoB;GAElD,MAAM,SAAS,IAAI,KAAK,cAAc,OAAO,eAAe;GAC5D,IAAI,CAAC,UAAU,OAAO,OAAO,YAAY,YAAY,OAAO;GAC5D,MAAM,OAAgB,OAAO,QAAQ;GACrC,IAAI,CAAC,MAAM,QAAQ,IAAI,KAAK,KAAK,WAAW,GAAG,OAAO;GAEtD,MAAM,MAAe,KAAK;GAC1B,IAAI,OAAO,QAAQ,YAAY,QAAQ,MAAM,OAAO;GACpD,IACE,CAAC,OAAO,OAAO,KAAK,OAAO,KAC3B,CAAC,OAAO,OAAO,KAAK,YAAY,KAChC,EAAE,WAAW,QACb,EAAE,gBAAgB,MAElB,OAAO;GAET,OAAO,IAAI,UAAU,SAAS,IAAI,eAAe;EACnD,QAAQ;GACN,OAAO;EACT;CACF;AACF"}

package/dist/index.d.ts

@@ -1,9 +1,11 @@
-import { a as DoPitrId, c as DoPitrUnavailableError, d as isDoPitrUnavailable, f as readDoPitrBookmark, i as DoPitrBookmarkRead, l as VelaDoPitrRpc, n as DoPitrArmOptions, o as DoPitrNamespace, p as CloudflareRoot, r as DoPitrArmResult, s as DoPitrStorage, t as VelaNonceDurableObject, u as armDoPitr } from "./nonce.durable-object-DffHMRnU.js";
-import { AsyncCacheStore, CacheEntry, CacheEntryReader, CacheEntryWriter, CacheInvalidationStore, DynamicModule, InjectionToken, NonceStore, RuntimeAdapter, ThrottlerStore, Type, VelaApplication, VelaMiddlewareHandler, VelaSecurityOptions } from "@velajs/vela";
-import { BroadcastCommand, ConnectedSocket, MessageBody, OnGatewayConnection, OnGatewayDisconnect, OnGatewayInit, SubscribeMessage, WebSocketGateway, WebSocketGatewayOptions, WebSocketSendGate, WebSocketServer, WsClient, WsDispatcher, WsException, WsMessage, WsResponse, WsServer } from "@velajs/vela/websocket";
-import { DownloadResult, PresignMethod, PresignedUrlResult, StorageBody, StorageDriver, UploadOptions, UploadResult } from "@velajs/vela/storage";
+import "./vela-env-DFvyoNT3.js";
+import { a as DoPitrId, c as DoPitrUnavailableError, d as isDoPitrUnavailable, f as readDoPitrBookmark, i as DoPitrBookmarkRead, l as VelaDoPitrRpc, n as DoPitrArmOptions, o as DoPitrNamespace, p as CloudflareRoot, r as DoPitrArmResult, s as DoPitrStorage, t as VelaNonceDurableObject, u as armDoPitr } from "./nonce.durable-object-Df4CZi-0.js";
+import { AsyncCacheStore, CacheEntry, CacheEntryReader, CacheEntryWriter, CacheInvalidationStore, DynamicModule, InjectionToken, NonceStore, RuntimeAdapter, ThrottlerStore, Type, VelaApplication, VelaEnv, VelaMiddlewareHandler, VelaSecurityOptions } from "@velajs/vela";
+import { BroadcastCommand, ConnectedSocket, MessageBody, OnGatewayConnection, OnGatewayDisconnect, OnGatewayInit, SubscribeMessage, UpgradeAuthenticator, WebSocketGateway, WebSocketGatewayOptions, WebSocketSendGate, WebSocketServer, WebSocketUpgradeAuthenticationContext, WebSocketUpgradeIdentity, WsClient, WsDispatcher, WsException, WsMessage, WsResponse, WsServer } from "@velajs/vela/websocket";
 import { CommitStamp, CursorLog, InvalidationCommand, LiveDriver, LiveEngine, LiveInvalidationSink, ResumeVerdict } from "@velajs/vela/live";
+import { DownloadResult, PresignMethod, PresignedUrlResult, StorageBody, StorageDriver, UploadOptions, UploadResult } from "@velajs/vela/storage";
 import { Context, ExecutionContext } from "hono";
+import "@velajs/vela/internal";
 import { FeatureFlagDriver, FlagContext } from "@velajs/feature-flags";
 //#region src/websocket/room-id.d.ts
 /** Stable, collision-free Durable Object name for one gateway's room. */
@@ -14,8 +16,63 @@ interface WsGatewayRoute {
   path: string;
   binding: string;
   options: WebSocketGatewayOptions;
+  /** Container module that declares the gateway; its authenticator resolves from here. */
+  moduleId?: string;
 }
 //#endregion
+//#region src/scheduled-event.d.ts
+/**
+ * The event a Worker's `scheduled()` export receives. The native
+ * `ScheduledController` satisfies it; direct calls (tests, scripts) may omit
+ * `scheduledTime`, which then defaults to the current time, and `noRetry`.
+ */
+interface ScheduledEvent {
+  readonly cron: string;
+  readonly scheduledTime?: number;
+  noRetry?(): void;
+}
+/** The Cloudflare trigger behind the current scheduled invocation. */
+interface CloudflareScheduledEvent {
+  /** The trigger's exact cron string; it equals the invocation's `expression`. */
+  readonly cron: string;
+  /** The platform's scheduled time in Unix milliseconds. */
+  readonly scheduledTime: number;
+  /**
+   * Ask Cloudflare not to retry this trigger if the invocation fails. Already
+   * bound to the native controller, so it can be passed around or destructured.
+   * A no-op for direct calls that supplied no controller.
+   */
+  readonly noRetry: () => void;
+}
+/**
+ * Request-scoped Cloudflare view of the scheduled trigger, seeded into each
+ * `@Cron` job's invocation scope by the Cloudflare adapter. Inject it where a
+ * job needs platform controls such as `noRetry()`; the job's argument stays
+ * the portable `ScheduleInvocation`. It resolves only inside a scheduled
+ * invocation; resolving it anywhere else throws. A cron job fired on demand
+ * (Studio's run-now) receives a synthetic event: `cron` is the job's
+ * expression and `noRetry()` does nothing.
+ *
+ * The token provides itself as request-scoped in every container, so a class
+ * that injects it is request-scoped wherever the graph boots (a Worker, a
+ * Durable Object, the CLI or a testing module) and is built only for an
+ * invocation, never at bootstrap.
+ *
+ * @example
+ * ```ts
+ * @Injectable({ scope: Scope.REQUEST })
+ * class Reports {
+ *   constructor(@Inject(CLOUDFLARE_SCHEDULED_EVENT) private readonly trigger: CloudflareScheduledEvent) {}
+ *
+ *   @Cron('0 3 * * *', { dialect: 'cloudflare' })
+ *   async nightly(tick: CronInvocation) {
+ *     if (!(await this.upstreamAvailable(tick.signal))) this.trigger.noRetry();
+ *   }
+ * }
+ * ```
+ */
+export declare const CLOUDFLARE_SCHEDULED_EVENT: InjectionToken<CloudflareScheduledEvent>;
+//#endregion
 //#region src/cloudflare-application.d.ts
 /**
  * Options accepted by {@link CloudflareApplication.mountOpenApi}.
@@ -28,15 +85,16 @@ type MountOpenApiOptions = Parameters<VelaApplication['mountOpenApi']>[0];
 /**
  * Wraps VelaApplication with Cloudflare-specific handlers:
  * - `fetch` — HTTP request handler (from Hono)
- * - `scheduled` — Cron trigger handler (matches `@Scheduled()` decorators
- *                 AND vela's own `@Cron()` jobs)
- * - `queue` — Queue consumer handler (matches `@QueueConsumer()` decorators)
+ * - `scheduled` — Cron trigger handler (runs the `@Cron()` jobs whose
+ *                 expression is the trigger's exact string)
+ * - `queue` — Queue consumer handler (`@QueueConsumer()` by physical queue,
+ *             then `QueueModule`'s native consumer)
  * - `mountOpenApi` — Serve an OpenAPI document (and optional Scalar UI) on
  *                    the underlying Hono app
  *
  * @example
  * ```ts
- * const app = await createCloudflareApp(AppModule, { env, envToken: ENV });
+ * const app = await createCloudflareApp(AppModule, { env });
  * export default {
  *   fetch: app.fetch,
  *   scheduled: app.scheduled.bind(app),
@@ -47,18 +105,18 @@ type MountOpenApiOptions = Parameters<VelaApplication['mountOpenApi']>[0];
  * @example
  * ```ts
  * // Serve OpenAPI docs alongside your routes
- * const app = await createCloudflareApp(AppModule, { env, envToken: ENV });
+ * const app = await createCloudflareApp(AppModule, { env });
  * const document = createOpenApiDocument(AppModule);
  * app.mountOpenApi({ document, ui: 'scalar' });
  * // GET /openapi.json -> JSON document
  * // GET /scalar       -> Scalar UI (loads from CDN)
  * ```
  */
-export declare class CloudflareApplication<T extends object = object> {
+export declare class CloudflareApplication {
   #private;
-  readonly env: T;
-  constructor(app: VelaApplication, env: T);
-  readonly fetch: (request: Request, env: T, ctx?: ExecutionContext) => Promise<Response>;
+  readonly env: VelaEnv;
+  constructor(app: VelaApplication, env: VelaEnv);
+  readonly fetch: (request: Request, env: VelaEnv, ctx?: ExecutionContext) => Promise<Response>;
   getHonoApp(): ReturnType<VelaApplication['getHonoApp']>;
   /**
    * Resolve a provider from the application's DI container (delegates to
@@ -68,7 +126,7 @@ export declare class CloudflareApplication<T extends object = object> {
    *
    * @example
    * ```ts
-   * const app = await createCloudflareApp(AppModule, { env, envToken: ENV });
+   * const app = await createCloudflareApp(AppModule, { env });
    * const auth = app.get(BetterAuthService);
    * ```
    */
@@ -85,7 +143,7 @@ export declare class CloudflareApplication<T extends object = object> {
    * ```ts
    * import { createOpenApiDocument } from '@velajs/vela';
    *
-   * const app = await createCloudflareApp(AppModule, { env, envToken: ENV });
+   * const app = await createCloudflareApp(AppModule, { env });
    * const document = createOpenApiDocument(AppModule, {
    *   info: { title: 'My API', version: '1.0.0' },
    * });
@@ -104,75 +162,104 @@ export declare class CloudflareApplication<T extends object = object> {
   /** @internal — upgrade routes discovered from the application's gateways. */
   getWsGatewayRoutes(): WsGatewayRoute[];
   /**
-   * Handle Cloudflare scheduled (cron) events.
-   * Matches the event's cron expression to `@Scheduled()` and vela `@Cron()`
-   * handlers read from `app.entrypoints`; each handler runs inside a fresh
-   * request-scoped child (request-scoped providers rebuild per tick).
+   * Handle a Cloudflare cron trigger. Runs every core `@Cron()` job whose
+   * expression is exactly `event.cron` (the trigger string is compared as
+   * delivered, never re-evaluated) through `invokeScheduledJob`, the dispatch
+   * primitive every runtime shares. Each job receives only its
+   * `ScheduleInvocation`, runs in a fresh invocation scope seeded with
+   * {@link CLOUDFLARE_SCHEDULED_EVENT}, and honors signed `ScheduleModule`
+   * dispatch. The trigger settles after every matching job and its managed
+   * work (`EXECUTION_LIFETIME.waitUntil`/`defer`) settle; failures reject it.
    */
-  scheduled(event: {
-    cron: string;
-    scheduledTime?: number;
-  }, env: T, ctx: {
+  scheduled(event: ScheduledEvent, env: VelaEnv, _ctx?: {
     waitUntil: (promise: Promise<unknown>) => void;
   }): Promise<void>;
   /**
-   * Run one entrypoint handler inside a fresh request scope, through the
-   * shared guard → interceptor pipeline (components declared with
+   * Run one queue consumer inside a fresh request scope, through the shared
+   * guard → interceptor pipeline (components declared with
    * `@UseGuards`/`@UseInterceptors`/`@UseFilters` on the consumer class or
    * method). HTTP-global components deliberately do NOT apply — an HTTP auth
-   * guard has no business rejecting a queue batch. Unclaimed errors rethrow
-   * so the platform's retry semantics stay intact.
+   * guard has no business rejecting a queue batch. Unclaimed errors are
+   * reported once (`QueueModule`'s consumer reports its own) and rethrow so
+   * the platform's retry semantics stay intact.
    */
   private dispatchEntrypoint;
   /**
-   * Handle Cloudflare Queue consumer events.
-   * Matches the batch queue name to `@QueueConsumer()` handlers read from
-   * `app.entrypoints`; each batch is processed inside a fresh request-scoped
-   * child (request-scoped providers rebuild per batch — no boot-time captives).
+   * Handle Cloudflare Queue consumer events. `@QueueConsumer()` handlers read
+   * from `app.entrypoints` claim a batch by its physical queue name and
+   * receive it whole. A batch no handler claims goes to `QueueModule`'s native
+   * consumer (`cloudflareQueues()` from `@velajs/cloudflare/queues`), which
+   * routes each job by its logical queue. Each dispatch runs inside a fresh
+   * request-scoped child (request-scoped providers rebuild per batch — no
+   * boot-time captives). A batch nothing claims rejects: resolving would let
+   * Cloudflare acknowledge every message implicitly.
    */
   queue(batch: {
     queue: string;
     messages: readonly unknown[];
-  }, env: T, ctx: {
+  }, env: VelaEnv, ctx: {
     waitUntil: (promise: Promise<unknown>) => void;
   }): Promise<void>;
+  /**
+   * A raw `@QueueConsumer` owns its physical queue's batches and must not carry
+   * jobs of a queue registered with `QueueModule`: those reach their
+   * `@Processor` only if the raw handler dispatches them itself, while
+   * `cloudflareQueues()` delivers registered queues. Warn once per physical and
+   * logical queue (unless diagnostics are silent); the raw consumer still
+   * receives and settles the batch.
+   */
+  private warnRawJobs;
+  /**
+   * Abort the signals of scheduled jobs still running, wait for them and their
+   * managed work to settle, then close the application.
+   */
   close(signal?: string): Promise<void>;
 }
 //#endregion
 //#region src/cloudflare-factory.d.ts
-interface CloudflareWorkerOptions<T extends object> {
-  /** Global typed DI token for the platform's native environment. */
-  envToken: InjectionToken<T>;
+interface CloudflareWorkerOptions {
   globalPrefix?: string;
   security?: VelaSecurityOptions;
-  /** Build request middleware from the same typed native environment as DI. */
-  middleware?: (env: NoInfer<T>) => VelaMiddlewareHandler[];
+  /** Build request middleware from the same native environment DI receives as ENV. */
+  middleware?: (env: VelaEnv) => VelaMiddlewareHandler[];
+  /** Further runtime adapters, composed after the Cloudflare adapter for each application. */
+  adapters?: RuntimeAdapter[];
 }
-interface CreateCloudflareAppOptions<T extends object> extends CloudflareWorkerOptions<T> {
+interface CreateCloudflareAppOptions extends CloudflareWorkerOptions {
   /** Supply the platform environment inside fetch/queue/scheduled or a DO constructor. */
-  env: NoInfer<T>;
+  env: VelaEnv;
 }
-/** Bind an application to one environment before provider factories and lifecycle hooks. */
-export declare function cloudflareAdapter<T extends object>(options: CreateCloudflareAppOptions<T>): RuntimeAdapter;
-/** Build an application for one native Workers environment. Call inside a platform event. */
-export declare function createCloudflareApp<T extends object>(rootModule: CloudflareRoot<NoInfer<T>>, options: CreateCloudflareAppOptions<T>): Promise<CloudflareApplication<T>>;
 /**
- * Worker entrypoint with one bootstrap per environment identity. Weak keys let
- * obsolete environments and secrets be collected. Concurrent cold events share
- * construction; failed construction is evicted so the next event can retry.
+ * Bind an application to one environment: seeded as the global ENV before
+ * provider factories and lifecycle hooks, and asserted on every request. The
+ * adapter also supplies the `InternalDispatcher` transport, so signed queue and
+ * schedule dispatch re-enter this application's routes, and reports schedule
+ * declarations a cron trigger cannot honor through the diagnostics policy.
  */
-export declare function createCloudflareWorker<T extends object>(rootModule: CloudflareRoot<NoInfer<T>>, options: CloudflareWorkerOptions<T>): {
-  fetch(request: Request, env: T, ctx: ExecutionContext): Promise<Response>;
-  scheduled(event: {
-    cron: string;
-    scheduledTime?: number;
-  }, env: T, ctx: {
+export declare function cloudflareAdapter(options: {
+  env: VelaEnv;
+}): RuntimeAdapter;
+/**
+ * Build an application for one native Workers environment. Call inside a platform event.
+ * The root is static: a module class or a `DynamicModule` declared at module scope.
+ * Read bindings in providers (`@InjectEnv()`) and module factories
+ * (`forRootAsync({ inject: [ENV], useFactory })`), which run for each application.
+ */
+export declare function createCloudflareApp(rootModule: CloudflareRoot, options: CreateCloudflareAppOptions): Promise<CloudflareApplication>;
+/**
+ * Worker entrypoint with one bootstrap per environment identity. Concurrent cold
+ * events share construction; failed construction is evicted so the next event
+ * can retry. Weak keys stop this cache from retaining a replaced environment.
+ */
+export declare function createCloudflareWorker(rootModule: CloudflareRoot, options?: CloudflareWorkerOptions): {
+  fetch(request: Request, env: VelaEnv, ctx: ExecutionContext): Promise<Response>;
+  scheduled(event: ScheduledEvent, env: VelaEnv, ctx?: {
     waitUntil: (promise: Promise<unknown>) => void;
   }): Promise<void>;
   queue(batch: {
     queue: string;
     messages: readonly unknown[];
-  }, env: T, ctx: {
+  }, env: VelaEnv, ctx: {
     waitUntil: (promise: Promise<unknown>) => void;
   }): Promise<void>;
 };
@@ -403,60 +490,6 @@ export declare class KvFlagDriver implements FeatureFlagDriver {
 /** Convenience factory for {@link KvFlagDriver}. */
 export declare function kvFlagDriver(kv: KVNamespace, options?: KvFlagDriverOptions): KvFlagDriver;
 //#endregion
-//#region src/decorators/env.d.ts
-/**
- * Parameter decorator to inject Cloudflare environment bindings.
- *
- * Without arguments, returns the entire `env` object.
- * With a binding name, returns that specific binding.
- *
- * @example
- * ```ts
- * @Get()
- * handle(@Env() env: WorkerEnv) { ... }
- *
- * @Get()
- * handle(@Env('MY_KV') kv: KVNamespace) { ... }
- * ```
- */
-export declare const Env: (data?: string | undefined, ...pipes: import("@velajs/vela").PipeType[]) => ParameterDecorator;
-//#endregion
-//#region src/decorators/scheduled.d.ts
-interface ScheduledMetadata {
-  cron: string;
-  methodName: string;
-}
-/** Compatible with the existing programmatic scheduled() entrypoint. */
-interface ScheduledEvent {
-  readonly cron: string;
-  readonly scheduledTime?: number;
-}
-/** Native controller passed unchanged to a Worker handler. Call noRetry on its receiver. */
-interface ScheduledController extends ScheduledEvent {
-  readonly scheduledTime: number;
-  noRetry(): void;
-}
-interface ScheduledContext {
-  waitUntil(promise: Promise<unknown>): void;
-}
-type ScheduledHandler<Env extends object = object> = (controller: ScheduledController, env: Env, context: ScheduledContext) => void | Promise<void>;
-export declare function parseScheduledMetadata(value: unknown): ScheduledMetadata;
-/**
- * Marks a method as a scheduled (cron) handler.
- *
- * @example
- * ```ts
- * @Injectable()
- * class WorkerService {
- *   @Scheduled('0 * * * *')
- *   async hourlyCron() {
- *     console.log('Running hourly');
- *   }
- * }
- * ```
- */
-export declare function Scheduled(cron: string): MethodDecorator;
-//#endregion
 //#region src/decorators/queue-consumer.d.ts
 interface QueueConsumerMetadata {
   queueName: string;
@@ -645,5 +678,5 @@ interface DurableObjectNonceStoreOptions {
  */
 export declare function durableObjectNonceStore(options: DurableObjectNonceStoreOptions): NonceStore;
 //#endregion
-export { type BroadcastNamespace, type CfLiveDriver, type CloudflareRateLimitBinding, type CloudflareRateLimitStoreOptions, type CloudflareRoot, type CloudflareWorkerOptions, ConnectedSocket, type CreateCloudflareAppOptions, type DiskConfig, type DoPitrArmOptions, type DoPitrArmResult, type DoPitrBookmarkRead, type DoPitrId, type DoPitrNamespace, type DoPitrStorage, DoPitrUnavailableError, type DurableObjectLiveOptions, type DurableObjectNonceNamespace, type DurableObjectNonceStoreOptions, type FlagshipBinding, type FlagshipFlagDriverOptions, type KvFlagDriverOptions, type LiveNamespace, MessageBody, type MountOpenApiOptions, type OnGatewayConnection, type OnGatewayDisconnect, type OnGatewayInit, type PresignedUrlConfig, type QueueConsumerMetadata, type ScheduledContext, type ScheduledController, type ScheduledEvent, type ScheduledHandler, type ScheduledMetadata, type StorageModuleOptions, SubscribeMessage, type VelaDoPitrRpc, WebSocketGateway, WebSocketServer, type WsClient, WsException, type WsGatewayRoute, type WsMessage, type WsResponse, type WsServer, armDoPitr, isDoPitrUnavailable, readDoPitrBookmark };
+export { type BroadcastNamespace, type CfLiveDriver, type CloudflareRateLimitBinding, type CloudflareRateLimitStoreOptions, type CloudflareRoot, type CloudflareScheduledEvent, type CloudflareWorkerOptions, ConnectedSocket, type CreateCloudflareAppOptions, type DiskConfig, type DoPitrArmOptions, type DoPitrArmResult, type DoPitrBookmarkRead, type DoPitrId, type DoPitrNamespace, type DoPitrStorage, DoPitrUnavailableError, type DurableObjectLiveOptions, type DurableObjectNonceNamespace, type DurableObjectNonceStoreOptions, type FlagshipBinding, type FlagshipFlagDriverOptions, type KvFlagDriverOptions, type LiveNamespace, MessageBody, type MountOpenApiOptions, type OnGatewayConnection, type OnGatewayDisconnect, type OnGatewayInit, type PresignedUrlConfig, type QueueConsumerMetadata, type ScheduledEvent, type StorageModuleOptions, SubscribeMessage, type UpgradeAuthenticator, type VelaDoPitrRpc, WebSocketGateway, WebSocketServer, type WebSocketUpgradeAuthenticationContext, type WebSocketUpgradeIdentity, type WsClient, WsException, type WsGatewayRoute, type WsMessage, type WsResponse, type WsServer, armDoPitr, isDoPitrUnavailable, readDoPitrBookmark };
 //# sourceMappingURL=index.d.ts.map